General

  • Target

    44491.6090605324.dat

  • Size

    890KB

  • Sample

    220613-pkwctscda6

  • MD5

    fdc89b23e17d46173806407132b2903c

  • SHA1

    e425a2d4cd89cb995a5fbf5e9b6671be8c51774f

  • SHA256

    95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d

  • SHA512

    f2dc346c36a879133cefb2ab5df55c1dcab5287630ccebf70d0baa043b65a2a64698f4083b0c2c8f9f7f83612ac0f3d277b120540d828d99ac3581068b007cda

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

biden54

Campaign

1634810637

C2

136.143.11.232:443

63.143.92.99:995

182.176.180.73:443

136.232.34.70:443

123.252.190.14:443

216.201.162.158:443

37.208.181.198:61200

140.82.49.12:443

197.89.144.102:443

89.137.52.44:443

109.12.111.14:443

78.191.24.189:995

105.198.236.99:995

196.207.140.40:995

41.235.69.115:443

2.222.167.138:443

117.198.156.56:443

24.231.209.2:6881

27.223.92.142:995

96.246.158.154:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      44491.6090605324.dat

    • Size

      890KB

    • MD5

      fdc89b23e17d46173806407132b2903c

    • SHA1

      e425a2d4cd89cb995a5fbf5e9b6671be8c51774f

    • SHA256

      95928b331e9942e4709b41ec8b59eb6f9e068f53ef2eeb15009feafd4ff5138d

    • SHA512

      f2dc346c36a879133cefb2ab5df55c1dcab5287630ccebf70d0baa043b65a2a64698f4083b0c2c8f9f7f83612ac0f3d277b120540d828d99ac3581068b007cda

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

1
T1112

Tasks