General

  • Target

    f4f9e02668cbfdd6f4c3061216adcbd8afa9e58a21c829f015d41148d3fb6f27

  • Size

    531KB

  • Sample

    220627-mmx84aaeaq

  • MD5

    8511b06e4d35132bfcb5416824936523

  • SHA1

    3e80f483fe00d8d4de32d1986068d312a9e14ae8

  • SHA256

    e6dea71e12c6e10612a718db9d5e9f562959bdb530982b7823fa71371cc61f28

  • SHA512

    e4799b939e9a6f19fe0a643e9d448efb0828d5a8f52bd5977f5f4efa5c5cf9f87ce2b84c6cb98e1073e64117b988e404feab519b806544e54360a4c45ca695ea

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

AA

Campaign

1655971687

C2

38.70.253.226:2222

47.23.89.60:993

120.150.218.241:995

117.248.109.38:21

37.34.253.233:443

86.132.14.70:2078

111.125.245.116:995

217.165.85.191:993

176.45.232.204:995

5.32.41.45:443

93.48.80.198:995

100.38.242.113:995

94.59.252.166:2222

74.14.5.179:2222

71.13.93.154:2222

193.253.44.249:2222

108.60.213.141:443

45.241.231.78:993

217.128.122.65:2222

40.134.246.185:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      f4f9e02668cbfdd6f4c3061216adcbd8afa9e58a21c829f015d41148d3fb6f27

    • Size

      1.1MB

    • MD5

      9b2708f727d79383dae1d09ba0b8d724

    • SHA1

      dc75d2a1db5b92f6ebbbc5ca2b66d0ee63aee6c7

    • SHA256

      f4f9e02668cbfdd6f4c3061216adcbd8afa9e58a21c829f015d41148d3fb6f27

    • SHA512

      fe679a52ca2e6b18c179655d136116fe646a2e5473561022b5fa4d01aff6d24c6ce3e458ed00e6742d594a316392988712adc9566f92c072cd7ca5ae17f92166

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks