General

  • Target

    146fc0ebaf0bb0706e9710a6b177c9fb7f3722637eb15eeb775e3974ded41286

  • Size

    531KB

  • Sample

    220627-mk9t4scch5

  • MD5

    120277e97a19f406ea2b7146055762d2

  • SHA1

    d3a2eda572909e426fd5b07990c7cbeea58773d2

  • SHA256

    4373e6edf324d002d78f05b5f42d8cd7adf7ea3566e07d7736e7f449d6dcae68

  • SHA512

    6d77ef86a10bda8cc9304ed3c902476c643fe9488651c43b692fb5050eb21be5e47932989e1e0070db665877560307b8a26943787b4ea6d9fb95ac8192e75eb5

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

AA

Campaign

1655971687

C2

38.70.253.226:2222

47.23.89.60:993

120.150.218.241:995

117.248.109.38:21

37.34.253.233:443

86.132.14.70:2078

111.125.245.116:995

217.165.85.191:993

176.45.232.204:995

5.32.41.45:443

93.48.80.198:995

100.38.242.113:995

94.59.252.166:2222

74.14.5.179:2222

71.13.93.154:2222

193.253.44.249:2222

108.60.213.141:443

45.241.231.78:993

217.128.122.65:2222

40.134.246.185:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      146fc0ebaf0bb0706e9710a6b177c9fb7f3722637eb15eeb775e3974ded41286

    • Size

      1.1MB

    • MD5

      0683720cc30a862365bc7b09362d9861

    • SHA1

      42caa823bebbdce1f479c1b49a2ea22ea5c99d11

    • SHA256

      146fc0ebaf0bb0706e9710a6b177c9fb7f3722637eb15eeb775e3974ded41286

    • SHA512

      f46306f905a63aa2cafc879f331bfe006612662c681fb930dcb505deb53ce3c0d5f26da745d74a2cce8433c0bfaa5a483020dcb9a316551e86534eb6a732a878

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks