General

  • Target

    bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.zip

  • Size

    529KB

  • Sample

    220729-27m17aeehp

  • MD5

    5106b081d73fdb9c6fb1d583943fb218

  • SHA1

    fde565c7f1750d244626de75f5116eddaf4f1ed7

  • SHA256

    15a8435db9724377f4d5babe3ffac26ad943787baf79487e67deeba5b4346147

  • SHA512

    6b589a9357b01ac1a4f389a8b26356bfc904732a5683507946d52a69ebc03b7da964ee5de55de04d1182a987e11cc935d7c9b3cc09d84b4136502036e93064a0

Malware Config

Extracted

Family

qakbot

Version

403.688

Botnet

AA

Campaign

1654852856

C2

172.115.177.204:2222

78.177.60.224:443

75.99.168.194:61201

124.40.244.115:2222

32.221.224.140:995

31.35.28.29:443

186.90.153.162:2222

1.161.123.53:995

197.87.182.115:443

86.132.14.70:2078

197.94.94.206:443

74.14.5.179:2222

148.0.56.63:443

217.165.84.253:993

39.44.235.10:995

67.165.206.193:993

210.246.4.69:995

182.191.92.203:995

117.248.109.38:21

1.161.123.53:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b.dll

    • Size

      979KB

    • MD5

      a54c368c81e44e3e30d39d20735eb2ae

    • SHA1

      5381365f8afa1c9dff0da4fdb19a9527b6bf8118

    • SHA256

      bba04c832f3e278361c826c4fafc70ec98d016d8ed5de6bc90db87a773cb658b

    • SHA512

      abed3a88c56293a6377a87038b3811a07948ddbfbda9c58f21b6fddf4e39b89a059c9d98f764f154df7eba0497ed55907f34fd266bc2917a2cb916e4e49d2cd2

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks