General

  • Target

    81a6093455e4941e41ca63a5e7387912228a0ed4

  • Size

    445KB

  • Sample

    220711-3e253sdhcr

  • MD5

    18b1d126cdaf2120bf3009f971cd08b4

  • SHA1

    81a6093455e4941e41ca63a5e7387912228a0ed4

  • SHA256

    59face6793dba844768077f3d8aa46b10b67245d0d7c8f6b42c19d80e48ab63a

  • SHA512

    a9dd8f0583ecb0bc96e1b46861c5cbb6ca11596ba1e33581f5f4fd130c2467b023b9b8945a89fdbd68a4d57c59ef80f4e5b78ef4522b1f67f124b577aaf42387

Malware Config

Extracted

Family

qakbot

Version

401.138

Botnet

krk01

Campaign

1611569149

C2

31.5.21.66:995

89.3.198.238:443

202.188.138.162:443

188.24.128.253:443

175.141.219.71:443

151.60.15.183:443

184.189.122.72:443

80.227.5.70:443

140.82.49.12:443

89.211.241.100:995

81.97.154.100:443

77.27.174.49:995

92.154.83.96:2078

42.3.8.54:443

71.187.170.235:443

46.153.36.53:995

71.182.142.63:443

105.186.102.16:443

50.244.112.106:443

78.63.226.32:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      81a6093455e4941e41ca63a5e7387912228a0ed4

    • Size

      445KB

    • MD5

      18b1d126cdaf2120bf3009f971cd08b4

    • SHA1

      81a6093455e4941e41ca63a5e7387912228a0ed4

    • SHA256

      59face6793dba844768077f3d8aa46b10b67245d0d7c8f6b42c19d80e48ab63a

    • SHA512

      a9dd8f0583ecb0bc96e1b46861c5cbb6ca11596ba1e33581f5f4fd130c2467b023b9b8945a89fdbd68a4d57c59ef80f4e5b78ef4522b1f67f124b577aaf42387

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks