General

  • Target

    241a9e733d5c15bd1bb9b391549cbc3a598ddd85bd639ab9aa157c2e563d002b

  • Size

    1.7MB

  • Sample

    220409-p8m2csehdq

  • MD5

    d51506a8b0de8ca71a682a723b8bb35f

  • SHA1

    caa5deefe04652b631f94055bf362eb8b69fedb7

  • SHA256

    241a9e733d5c15bd1bb9b391549cbc3a598ddd85bd639ab9aa157c2e563d002b

  • SHA512

    b3995cf3af9b6bba3180875d68dafd3bae57322699e14efea9af1125f46813f19c0078b7ff09ba02e1fdbd16fcb06b8115e6d50ee62d998852e8039d194ec415

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

AA

Campaign

1649273304

C2

83.110.75.97:2222

47.23.89.62:993

187.207.48.194:61202

45.63.1.12:995

140.82.63.183:995

45.76.167.26:995

140.82.63.183:443

144.202.2.175:995

144.202.3.39:443

149.28.238.199:443

144.202.3.39:995

45.63.1.12:443

149.28.238.199:995

45.76.167.26:443

144.202.2.175:443

100.1.108.246:443

32.221.224.140:995

24.55.67.176:443

31.35.28.29:443

70.51.134.168:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      241a9e733d5c15bd1bb9b391549cbc3a598ddd85bd639ab9aa157c2e563d002b

    • Size

      1.7MB

    • MD5

      d51506a8b0de8ca71a682a723b8bb35f

    • SHA1

      caa5deefe04652b631f94055bf362eb8b69fedb7

    • SHA256

      241a9e733d5c15bd1bb9b391549cbc3a598ddd85bd639ab9aa157c2e563d002b

    • SHA512

      b3995cf3af9b6bba3180875d68dafd3bae57322699e14efea9af1125f46813f19c0078b7ff09ba02e1fdbd16fcb06b8115e6d50ee62d998852e8039d194ec415

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks