General

  • Target

    ba526a77456aae86770ea4fc7e37b5bc2ac8c4bb5b399c53ba8569337e91a6c1

  • Size

    531KB

  • Sample

    220624-re3aasfed5

  • MD5

    ae49aa307c5e9986f247847c954ff504

  • SHA1

    ce889dacc4da4607249239788c899d5f8a2b9af0

  • SHA256

    858fef7800400ca8ffa7e5da3a29ef1d38b2d7b5f1de403a3bb204322b6de2ff

  • SHA512

    3096f5d9e39069cbca5b5925054d608b92c9f1ecdf8a5c1218ce837613308b26d47d78dc530e40a8771e0240852967a5638cdf4110c8ac04ba532919902c35f5

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

AA

Campaign

1655971687

C2

38.70.253.226:2222

47.23.89.60:993

120.150.218.241:995

117.248.109.38:21

37.34.253.233:443

86.132.14.70:2078

111.125.245.116:995

217.165.85.191:993

176.45.232.204:995

5.32.41.45:443

93.48.80.198:995

100.38.242.113:995

94.59.252.166:2222

74.14.5.179:2222

71.13.93.154:2222

193.253.44.249:2222

108.60.213.141:443

45.241.231.78:993

217.128.122.65:2222

40.134.246.185:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      ba526a77456aae86770ea4fc7e37b5bc2ac8c4bb5b399c53ba8569337e91a6c1

    • Size

      1.1MB

    • MD5

      8c9291f1a71acb7ea403e4a85d28bd58

    • SHA1

      47637280656653ee26e2eadce3ae5e5048fa4836

    • SHA256

      ba526a77456aae86770ea4fc7e37b5bc2ac8c4bb5b399c53ba8569337e91a6c1

    • SHA512

      da5b5f563ae23f9db044e2c9497d031ef3af3eb3d366934c7136d655730b4a490e4a7c2e8861c2ccd7019141d7121ae61b3ea5c36181f606dc35cf5d110cfe3d

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks