General

  • Target

    c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166

  • Size

    1.1MB

  • Sample

    220706-yzp9ssgffm

  • MD5

    8f24a209d47eae18b6f6b5b3b5806982

  • SHA1

    c9dfcb0ea4efd3920c8f89d9ba0ad6ce0df3dbd6

  • SHA256

    c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166

  • SHA512

    49d9adb4ad98e4dadaf092df7921c3b08cb93965ba9d486e7767a81689d501deb9cc187f5fff61beed29dd35daf9e94bfa7439e84dc28766f80acddeb807cc39

Malware Config

Extracted

Family

qakbot

Version

403.573

Botnet

AA

Campaign

1651213605

C2

74.14.7.71:2222

1.161.104.149:443

1.161.104.149:995

24.152.219.253:995

180.129.20.164:995

46.107.48.202:443

118.172.250.162:443

102.65.38.74:443

76.25.142.196:443

93.48.80.198:995

47.23.89.62:995

2.34.12.8:443

38.70.253.226:2222

47.23.89.62:993

75.99.168.194:443

41.228.22.180:443

148.64.96.100:443

108.60.213.141:443

172.114.160.81:443

140.82.49.12:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166

    • Size

      1.1MB

    • MD5

      8f24a209d47eae18b6f6b5b3b5806982

    • SHA1

      c9dfcb0ea4efd3920c8f89d9ba0ad6ce0df3dbd6

    • SHA256

      c7eb0facf612dbf76f5e3fe665fe0c4bfed48d94edc872952a065139720e3166

    • SHA512

      49d9adb4ad98e4dadaf092df7921c3b08cb93965ba9d486e7767a81689d501deb9cc187f5fff61beed29dd35daf9e94bfa7439e84dc28766f80acddeb807cc39

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks