General

  • Target

    21b2e83f0a0b8ae8c421280a4a184016b364639fec0c3b411e933882862e6d9f

  • Size

    364KB

  • Sample

    220627-lq5xnsabgr

  • MD5

    6f237f6ec2021ff4bd2189d80fa807fc

  • SHA1

    42f975725eafbaaa31345fa53097ca4abaccc1d7

  • SHA256

    8cd8c7a9a548b8da6a710f0fe07cdbcdf6d8cf1c51a7f0811035058ffd643f7f

  • SHA512

    ca38ca3fe5406ed6f647c066ce5c62019a3e115e666ff16a91feee2b66494b877aba2fe1e6472ef44810608a74df1080b3c7f62616415b052293152f133e2925

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

AA

Campaign

1656051427

C2

217.128.122.65:2222

24.43.99.75:443

67.209.195.198:443

208.107.221.224:443

70.46.220.114:443

32.221.224.140:995

88.241.122.55:443

186.90.153.162:2222

148.64.96.100:443

197.87.182.93:443

39.44.30.209:995

67.165.206.193:993

118.161.2.13:995

111.125.245.116:995

104.34.212.7:32103

86.200.151.188:2222

41.228.22.180:443

94.59.15.180:2222

24.178.196.158:2222

182.191.92.203:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      21b2e83f0a0b8ae8c421280a4a184016b364639fec0c3b411e933882862e6d9f

    • Size

      713KB

    • MD5

      76a69a36c3826494f1539c283b4a3b52

    • SHA1

      c11b7bb8e24a50068c58257bd98aada6c0e0f9b9

    • SHA256

      21b2e83f0a0b8ae8c421280a4a184016b364639fec0c3b411e933882862e6d9f

    • SHA512

      cdd241ddb5f0cf7408bbd1e729ed67479f56c699ae8bf8be72ef6ed7ecb6cc68b3e13dcd14aeb33c83594cb53549b5e4e7d16d1a26dc691bccf447fba76162a3

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks