General

  • Target

    bde66b4246cfbb415549464b424ffd581885dc8a2b85cb2d2676ead4d66b64e8

  • Size

    1.3MB

  • Sample

    220525-radq5sahe5

  • MD5

    8930a6c6ead6fb9e38c0b3095566ed39

  • SHA1

    4a7d1881f0a93a3328ce4c23f688fa84fb921932

  • SHA256

    bde66b4246cfbb415549464b424ffd581885dc8a2b85cb2d2676ead4d66b64e8

  • SHA512

    9ee1a9de5ae57a4db8f6d8b855c2d111d0ad9410e6cf06fd0e0f6ce77c27ba6aa4bb7f54b0150d09ca546a2c22679850d6b3d2d070f431390e56c27390b81b34

Malware Config

Extracted

Family

qakbot

Version

403.690

Botnet

AA

Campaign

1653399733

C2

1.161.104.31:443

47.156.131.10:443

201.172.23.68:2222

187.251.132.144:22

31.215.69.176:443

191.250.188.54:443

93.48.80.198:995

80.11.74.81:2222

38.70.253.226:2222

100.1.108.246:443

5.32.41.45:443

188.161.200.40:995

201.242.206.44:2222

208.107.221.224:443

47.23.89.60:993

75.99.168.194:443

103.246.242.202:443

200.148.9.225:32101

37.210.169.150:2222

79.129.121.68:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      bde66b4246cfbb415549464b424ffd581885dc8a2b85cb2d2676ead4d66b64e8

    • Size

      1.3MB

    • MD5

      8930a6c6ead6fb9e38c0b3095566ed39

    • SHA1

      4a7d1881f0a93a3328ce4c23f688fa84fb921932

    • SHA256

      bde66b4246cfbb415549464b424ffd581885dc8a2b85cb2d2676ead4d66b64e8

    • SHA512

      9ee1a9de5ae57a4db8f6d8b855c2d111d0ad9410e6cf06fd0e0f6ce77c27ba6aa4bb7f54b0150d09ca546a2c22679850d6b3d2d070f431390e56c27390b81b34

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks