General

  • Target

    0a4ac14725b88aff8573e7fe775b708cab956fd6c2c6a9c6bf41c76c58c85d5b

  • Size

    1.3MB

  • Sample

    220811-j6dr1sfbc4

  • MD5

    5db3fd7c47a60dd0dc5c9b9733ef3a28

  • SHA1

    9c6bedc01368ebad082fcab4c5bf32cd6ccd17e7

  • SHA256

    0a4ac14725b88aff8573e7fe775b708cab956fd6c2c6a9c6bf41c76c58c85d5b

  • SHA512

    b1845e18e16954032e34392bbeaef839bd991d7d4106e2467b20cdf01927ca3ed4191762b3d58739c5d901df06d2fe6a6c83abef5a0b63668fcd835bb1a69e99

Malware Config

Extracted

Family

qakbot

Version

403.690

Botnet

AA

Campaign

1653399733

C2

1.161.104.31:443

47.156.131.10:443

201.172.23.68:2222

187.251.132.144:22

31.215.69.176:443

191.250.188.54:443

93.48.80.198:995

80.11.74.81:2222

38.70.253.226:2222

100.1.108.246:443

5.32.41.45:443

188.161.200.40:995

201.242.206.44:2222

208.107.221.224:443

47.23.89.60:993

75.99.168.194:443

103.246.242.202:443

200.148.9.225:32101

37.210.169.150:2222

79.129.121.68:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      0a4ac14725b88aff8573e7fe775b708cab956fd6c2c6a9c6bf41c76c58c85d5b

    • Size

      1.3MB

    • MD5

      5db3fd7c47a60dd0dc5c9b9733ef3a28

    • SHA1

      9c6bedc01368ebad082fcab4c5bf32cd6ccd17e7

    • SHA256

      0a4ac14725b88aff8573e7fe775b708cab956fd6c2c6a9c6bf41c76c58c85d5b

    • SHA512

      b1845e18e16954032e34392bbeaef839bd991d7d4106e2467b20cdf01927ca3ed4191762b3d58739c5d901df06d2fe6a6c83abef5a0b63668fcd835bb1a69e99

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks