General

  • Target

    8c10efd39592a46d46a2ef7a66256f1184462004950197f6ec45354a609eb572

  • Size

    1.7MB

  • Sample

    220801-r5hctaheg3

  • MD5

    5c63123961258ed956a588308867d500

  • SHA1

    08c190d8e4518bbfe0e76e4285fa0fcc2e3a40df

  • SHA256

    8c10efd39592a46d46a2ef7a66256f1184462004950197f6ec45354a609eb572

  • SHA512

    6f698f2e8ac1b0ad0961c1a0dc39e9b56cd8c0a15bb46ed290fa862158a478c69f6f2839c77cd8833ae6369150ae6f3539ac5411695a29073346233bad926b04

Malware Config

Extracted

Family

qakbot

Version

403.10

Botnet

obama153

Campaign

1643117667

C2

217.128.93.27:2222

94.200.181.154:995

24.95.61.62:443

39.44.254.218:995

69.14.172.24:443

31.215.68.214:443

173.25.166.81:443

70.163.1.219:443

24.178.196.158:2222

89.101.97.139:443

108.4.67.252:443

217.128.171.34:2222

149.135.101.20:443

38.70.253.226:2222

24.222.20.254:443

74.15.2.252:2222

185.152.45.170:995

209.210.95.228:32100

71.74.12.34:443

180.233.150.134:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      8c10efd39592a46d46a2ef7a66256f1184462004950197f6ec45354a609eb572

    • Size

      1.7MB

    • MD5

      5c63123961258ed956a588308867d500

    • SHA1

      08c190d8e4518bbfe0e76e4285fa0fcc2e3a40df

    • SHA256

      8c10efd39592a46d46a2ef7a66256f1184462004950197f6ec45354a609eb572

    • SHA512

      6f698f2e8ac1b0ad0961c1a0dc39e9b56cd8c0a15bb46ed290fa862158a478c69f6f2839c77cd8833ae6369150ae6f3539ac5411695a29073346233bad926b04

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks