Resubmissions

11-09-2022 11:30

220911-nmg3jsbeb9 10

11-09-2022 10:49

220911-mwvvbsbdh4 10

08-09-2022 20:23

220908-y54z5sfha5 10

General

  • Target

    627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87

  • Size

    525KB

  • Sample

    220908-y54z5sfha5

  • MD5

    1d1ab6ac00c3ed27bf2a4b1f4a0007a1

  • SHA1

    6774518bb3a0e81aea7df6fc57d90187e214fc3d

  • SHA256

    627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87

  • SHA512

    153bf3adbf03aea21b3f2664cad36747f046002b635830478145016b0d148f380250679949638f491073f997ef89b776480d021f1ae1799308c16954a5948d58

  • SSDEEP

    12288:yWghjfsaHKisYUVJAEvyxN7UDIC6hD3jkYm:BijHHKH53vU7UsNxwn

Malware Config

Extracted

Family

qakbot

Version

403.780

Botnet

azd

Campaign

1661969003

C2

72.252.157.93:990

72.252.157.93:995

187.172.230.151:443

46.107.48.202:443

70.46.220.114:443

173.189.167.21:995

93.48.80.198:995

99.232.140.205:2222

89.211.179.14:2222

37.210.148.30:995

182.191.92.203:995

41.228.22.180:443

70.51.153.182:2222

47.180.172.159:443

47.23.89.61:993

173.21.10.71:2222

208.107.221.224:443

76.25.142.196:443

63.143.92.99:995

24.158.23.166:995

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87

    • Size

      525KB

    • MD5

      1d1ab6ac00c3ed27bf2a4b1f4a0007a1

    • SHA1

      6774518bb3a0e81aea7df6fc57d90187e214fc3d

    • SHA256

      627967aa04631496b1bd5e502bd0c461e5991ff65eaa0f1714b8053351157e87

    • SHA512

      153bf3adbf03aea21b3f2664cad36747f046002b635830478145016b0d148f380250679949638f491073f997ef89b776480d021f1ae1799308c16954a5948d58

    • SSDEEP

      12288:yWghjfsaHKisYUVJAEvyxN7UDIC6hD3jkYm:BijHHKH53vU7UsNxwn

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Tasks