General

  • Target

    0702d4bae0d88edb6f1d72b8c9d7795271bcd25a58bc198b192e7bebc73d828c

  • Size

    2.0MB

  • Sample

    220307-pe1qcshbdk

  • MD5

    850d7492a20d899a2e9cc8b6c737eb0b

  • SHA1

    cea72917b226c317125f265f3921270ec889c706

  • SHA256

    0702d4bae0d88edb6f1d72b8c9d7795271bcd25a58bc198b192e7bebc73d828c

  • SHA512

    49d0dcbb69c137932629a517588b56ff13e9a7fc7562366feacabd48125ccef353c6da26342d3ae16604faa279001d9233a9224b2ccb16151735413f6fae7e46

Malware Config

Extracted

Family

qakbot

Attributes
  • salt

    �1o��1���1/�x0O��0��83�D3���

Extracted

Family

qakbot

Version

401.72

Botnet

abc110

Campaign

1607524278

C2

78.63.226.32:443

72.252.201.69:443

68.190.152.98:443

72.240.200.181:2222

216.137.142.200:2222

87.27.110.90:2222

94.69.242.254:2222

189.183.209.211:443

94.26.119.221:443

186.189.208.238:443

161.199.180.159:443

197.45.110.165:995

83.110.221.218:443

105.198.236.99:443

83.110.158.22:2222

24.37.178.158:443

185.105.131.233:443

79.101.206.250:995

92.154.83.96:2078

83.202.68.220:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      0702d4bae0d88edb6f1d72b8c9d7795271bcd25a58bc198b192e7bebc73d828c

    • Size

      2.0MB

    • MD5

      850d7492a20d899a2e9cc8b6c737eb0b

    • SHA1

      cea72917b226c317125f265f3921270ec889c706

    • SHA256

      0702d4bae0d88edb6f1d72b8c9d7795271bcd25a58bc198b192e7bebc73d828c

    • SHA512

      49d0dcbb69c137932629a517588b56ff13e9a7fc7562366feacabd48125ccef353c6da26342d3ae16604faa279001d9233a9224b2ccb16151735413f6fae7e46

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks