General

  • Target

    7658786120.zip

  • Size

    221KB

  • Sample

    220701-eflbysahgk

  • MD5

    e607a515c7e5575b4c7fe535f276c930

  • SHA1

    e4a4f91c71584bb81699ec24bb98a09c3ddab193

  • SHA256

    66b6d310a2190377dc393cdd50ae0bdb7dd279e4007dccf689c21f22ec424d7f

  • SHA512

    3e557fb6f9ab587bec7f28c108a2726cb451581d3e8aa49760afbe8e54b072c63e705843e9fc89142041e9e0f57991849bc7f289bb48908d42fb9e5e1d0e3065

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

obama195

Campaign

1656400725

C2

74.14.5.179:2222

104.34.212.7:32103

142.186.49.224:2222

93.48.80.198:995

94.59.15.180:2222

217.128.122.65:2222

45.241.173.232:993

24.43.99.75:443

89.101.97.139:443

70.46.220.114:443

32.221.224.140:995

67.209.195.198:443

37.34.253.233:443

80.11.74.81:2222

81.214.215.234:443

67.165.206.193:993

173.174.216.62:443

186.90.153.162:2222

148.64.96.100:443

176.205.23.138:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      eb1f39be0bca79380a50996f36e4df0995452dfa4cbb23c8cd66012a45f8c13c

    • Size

      377KB

    • MD5

      de2a14bc29d5913d47d503bfd49afb70

    • SHA1

      fa8a46aee5e375ff75263da7788845a8793acb61

    • SHA256

      eb1f39be0bca79380a50996f36e4df0995452dfa4cbb23c8cd66012a45f8c13c

    • SHA512

      c6edd36ef9a5f48d81700d3f704a67b3ae9a7bd645ab2014dbeb23213484d464f4b147c379f1e14f7028a6a94a2bf2264ba45039eb508b490e36db52989a18e0

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks