General

  • Target

    0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8

  • Size

    1.7MB

  • Sample

    220408-xnnfdsddcl

  • MD5

    94faab5bb36e576d46c1466e820b9fdd

  • SHA1

    6488a57a83b8342c8c544eecc7cebe82e3213f93

  • SHA256

    0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8

  • SHA512

    14614ae97be5bb36c5981d293e265fe7a73e32521da34e23f72cb715337f22e95ffd2826a20ecaa522dbf418ae6ccfaa4713b6f2f2e60e04222d998f68db3520

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

AA

Campaign

1649273304

C2

83.110.75.97:2222

47.23.89.62:993

187.207.48.194:61202

45.63.1.12:995

140.82.63.183:995

45.76.167.26:995

140.82.63.183:443

144.202.2.175:995

144.202.3.39:443

149.28.238.199:443

144.202.3.39:995

45.63.1.12:443

149.28.238.199:995

45.76.167.26:443

144.202.2.175:443

100.1.108.246:443

32.221.224.140:995

24.55.67.176:443

31.35.28.29:443

70.51.134.168:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8

    • Size

      1.7MB

    • MD5

      94faab5bb36e576d46c1466e820b9fdd

    • SHA1

      6488a57a83b8342c8c544eecc7cebe82e3213f93

    • SHA256

      0055433d0ad98365cbaba95f462953bc0d8dcfe813005d5efb43c569abc69ac8

    • SHA512

      14614ae97be5bb36c5981d293e265fe7a73e32521da34e23f72cb715337f22e95ffd2826a20ecaa522dbf418ae6ccfaa4713b6f2f2e60e04222d998f68db3520

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks