General

  • Target

    921fd0e521df42f30dddfa94b641fb77f54ed19b775449cc714b46cd94ca86a8

  • Size

    1.0MB

  • Sample

    220618-dhb1maecbp

  • MD5

    9ade96926c022b1bab77ecfc2f2cfa0a

  • SHA1

    216d1f26d6ecc1e6abecfe8f5244de7f4b0242ad

  • SHA256

    921fd0e521df42f30dddfa94b641fb77f54ed19b775449cc714b46cd94ca86a8

  • SHA512

    89d6d430b3169f461412374273b7e1d638bac4db61c65f9acaecd93f6b8844ec13a5586b2197707901a86b1d5c9bfb32fdb9e2a9b8a1141c03b4f9808e4db9ad

Malware Config

Extracted

Family

qakbot

Version

403.688

Botnet

obama189

Campaign

1655107308

C2

91.177.173.10:995

117.248.109.38:21

182.191.92.203:995

39.52.38.164:995

217.165.84.253:993

84.241.8.23:32103

82.152.39.39:443

202.134.152.2:2222

122.118.131.132:995

120.150.218.241:995

222.169.71.98:2222

37.34.253.233:443

93.48.80.198:995

148.0.55.173:443

175.145.235.37:443

41.130.140.32:993

120.61.0.71:443

89.101.97.139:443

62.204.41.187:443

62.204.41.187:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      921fd0e521df42f30dddfa94b641fb77f54ed19b775449cc714b46cd94ca86a8

    • Size

      1.0MB

    • MD5

      9ade96926c022b1bab77ecfc2f2cfa0a

    • SHA1

      216d1f26d6ecc1e6abecfe8f5244de7f4b0242ad

    • SHA256

      921fd0e521df42f30dddfa94b641fb77f54ed19b775449cc714b46cd94ca86a8

    • SHA512

      89d6d430b3169f461412374273b7e1d638bac4db61c65f9acaecd93f6b8844ec13a5586b2197707901a86b1d5c9bfb32fdb9e2a9b8a1141c03b4f9808e4db9ad

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks