General

  • Target

    627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87

  • Size

    525KB

  • Sample

    220908-tcpmjafaa7

  • MD5

    07c8c11cc4ef73de943134ab8e71850d

  • SHA1

    6dffeac5550fd6b2af6738e6cda834767d41a2e5

  • SHA256

    4eb7a871f9b479a9d719233dbd9f45c034e9fcf97cf70244f6d6eeaa48665a4d

  • SHA512

    4d1f5d32c04ff8e4beb03cc8709ab5e073b4b18d21b6bbe59ab8198e92989d78a45e28234bc9c821455685bcdffc61732d2a00892b2bda396f194244fb68ebf2

  • SSDEEP

    12288:sWghjfsaHKisYUVJAEvyxN7UDIC6hD3jkYm:jijHHKH53vU7UsNxwn

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

azd

Campaign

1661969003

C2

72.252.157.93:990

72.252.157.93:995

187.172.230.151:443

46.107.48.202:443

70.46.220.114:443

173.189.167.21:995

93.48.80.198:995

99.232.140.205:2222

89.211.179.14:2222

37.210.148.30:995

182.191.92.203:995

41.228.22.180:443

70.51.153.182:2222

47.180.172.159:443

47.23.89.61:993

173.21.10.71:2222

208.107.221.224:443

76.25.142.196:443

63.143.92.99:995

24.158.23.166:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87

    • Size

      525KB

    • MD5

      07c8c11cc4ef73de943134ab8e71850d

    • SHA1

      6dffeac5550fd6b2af6738e6cda834767d41a2e5

    • SHA256

      4eb7a871f9b479a9d719233dbd9f45c034e9fcf97cf70244f6d6eeaa48665a4d

    • SHA512

      4d1f5d32c04ff8e4beb03cc8709ab5e073b4b18d21b6bbe59ab8198e92989d78a45e28234bc9c821455685bcdffc61732d2a00892b2bda396f194244fb68ebf2

    • SSDEEP

      12288:sWghjfsaHKisYUVJAEvyxN7UDIC6hD3jkYm:jijHHKH53vU7UsNxwn

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks