General

  • Target

    dcf1f180121a9b9c9dac26765835f06fcf185e69eceabb10201135f68c0d8a27

  • Size

    2.2MB

  • Sample

    220319-g344padbbj

  • MD5

    393daf31bc41ce6a97bac6e435e2932e

  • SHA1

    e33468bcf6295d7f4e95d46ddf369ef26bf3cc47

  • SHA256

    dcf1f180121a9b9c9dac26765835f06fcf185e69eceabb10201135f68c0d8a27

  • SHA512

    bb07088c07168e711ea0efe65fdfd10d3a95018e0b48175c8a3f150828fb62f72086c593c0fe7fc51bde4110ce875f4e9923c7293bfd10d9ae902d0ffeff4ed6

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

tr02

Campaign

1608026105

C2

111.95.212.237:2222

190.220.8.10:995

109.154.79.222:2222

83.110.250.71:995

149.28.99.97:2222

45.63.107.192:443

149.28.101.90:2222

149.28.101.90:995

149.28.99.97:443

149.28.98.196:443

144.202.38.185:2222

45.77.115.208:995

149.28.98.196:2222

149.28.98.196:995

149.28.99.97:995

45.63.107.192:2222

144.202.38.185:995

144.202.38.185:443

45.63.107.192:995

5.13.84.186:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      dcf1f180121a9b9c9dac26765835f06fcf185e69eceabb10201135f68c0d8a27

    • Size

      2.2MB

    • MD5

      393daf31bc41ce6a97bac6e435e2932e

    • SHA1

      e33468bcf6295d7f4e95d46ddf369ef26bf3cc47

    • SHA256

      dcf1f180121a9b9c9dac26765835f06fcf185e69eceabb10201135f68c0d8a27

    • SHA512

      bb07088c07168e711ea0efe65fdfd10d3a95018e0b48175c8a3f150828fb62f72086c593c0fe7fc51bde4110ce875f4e9923c7293bfd10d9ae902d0ffeff4ed6

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks