General

  • Target

    d698370bf405a8cd74807fece4ed957e39a6e78a792a765c90b8a39b8af1f2cb

  • Size

    692KB

  • Sample

    220628-hsm8vshef7

  • MD5

    5f57d9c73c2526a8123668d35fe9449e

  • SHA1

    d94ccf58914804c7fc5e302362e207a000dbba4d

  • SHA256

    d698370bf405a8cd74807fece4ed957e39a6e78a792a765c90b8a39b8af1f2cb

  • SHA512

    9317f13274235f5a680674e58e6b6393e3a676b95f1e82943995349994c444be4fc4b8985fd65105e44e4c6b5582b24ee7bd5ff258f22b7ef6e8fbc344e0a989

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

AA

Campaign

1656051427

C2

217.128.122.65:2222

24.43.99.75:443

67.209.195.198:443

208.107.221.224:443

70.46.220.114:443

32.221.224.140:995

88.241.122.55:443

186.90.153.162:2222

148.64.96.100:443

197.87.182.93:443

39.44.30.209:995

67.165.206.193:993

118.161.2.13:995

111.125.245.116:995

104.34.212.7:32103

86.200.151.188:2222

41.228.22.180:443

94.59.15.180:2222

24.178.196.158:2222

182.191.92.203:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      d698370bf405a8cd74807fece4ed957e39a6e78a792a765c90b8a39b8af1f2cb

    • Size

      692KB

    • MD5

      5f57d9c73c2526a8123668d35fe9449e

    • SHA1

      d94ccf58914804c7fc5e302362e207a000dbba4d

    • SHA256

      d698370bf405a8cd74807fece4ed957e39a6e78a792a765c90b8a39b8af1f2cb

    • SHA512

      9317f13274235f5a680674e58e6b6393e3a676b95f1e82943995349994c444be4fc4b8985fd65105e44e4c6b5582b24ee7bd5ff258f22b7ef6e8fbc344e0a989

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks