General

  • Target

    454cab7d08e79574023d86735fbd87ea84a1e36af097e29fff4a54186269858a

  • Size

    741KB

  • Sample

    220505-vhdmwsgdc7

  • MD5

    e0af488d21a58e77ccc509f2a0f6e204

  • SHA1

    d7c417ecd18f6e492301b1d0d582639841cf0792

  • SHA256

    454cab7d08e79574023d86735fbd87ea84a1e36af097e29fff4a54186269858a

  • SHA512

    290aa057843de7036e562982bf0b64ab403454a9c52f55a3a32e658fe15aa76ef22c0313c803508c83075bb2f23d3b141f30375f2989983b9a400f6e784589f2

Malware Config

Extracted

Family

qakbot

Version

403.683

Botnet

obama182

Campaign

1651756499

C2

103.107.113.120:443

80.11.74.81:2222

177.102.2.175:32101

24.178.196.158:2222

91.177.173.10:995

181.208.248.227:443

176.67.56.94:443

202.134.152.2:2222

148.0.57.85:443

179.179.162.9:993

40.134.246.185:995

37.186.54.254:995

196.203.37.215:80

120.150.218.241:995

208.107.221.224:443

113.53.151.59:443

70.46.220.114:443

69.14.172.24:443

108.60.213.141:443

24.55.67.176:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      454cab7d08e79574023d86735fbd87ea84a1e36af097e29fff4a54186269858a

    • Size

      741KB

    • MD5

      e0af488d21a58e77ccc509f2a0f6e204

    • SHA1

      d7c417ecd18f6e492301b1d0d582639841cf0792

    • SHA256

      454cab7d08e79574023d86735fbd87ea84a1e36af097e29fff4a54186269858a

    • SHA512

      290aa057843de7036e562982bf0b64ab403454a9c52f55a3a32e658fe15aa76ef22c0313c803508c83075bb2f23d3b141f30375f2989983b9a400f6e784589f2

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks