Resubmissions

14-09-2022 14:54

220914-r94fvaafb7 10

14-09-2022 14:50

220914-r7nydaecgp 10

General

  • Target

    1240-57-0x0000000000120000-0x0000000000142000-memory.dmp

  • Size

    136KB

  • Sample

    220914-r94fvaafb7

  • MD5

    efb5f7159bc194e25cea0d3402da2501

  • SHA1

    8ef75319ba4186331bdcce64e586304907047857

  • SHA256

    7b4e8bdfed375e3d82a47743e185c82b5474f1358e4a78fee68d1beb4320b65c

  • SHA512

    12cd2181b09f061d9f4e1b0c1927d370cec0aa99480a73476eb2c61f1abb2cedf4ff801e368278786baf160eeac85ab813c07ceb8831f5ad18f81805dec86787

  • SSDEEP

    3072:m9NzPp1RYGqwBLLFqGAnJ0632wTBfFGQaFAy:+rvRYpwBLL8jnJd32wTB9JIF

Malware Config

Extracted

Family

qakbot

Version

403.858

Botnet

obama202

Campaign

1663062752

C2

99.232.140.205:2222

41.69.118.117:995

179.111.111.88:32101

37.210.148.30:995

47.146.182.110:443

191.97.234.238:995

64.207.215.69:443

88.233.194.154:2222

81.131.161.131:2078

86.98.156.176:993

200.161.62.126:32101

88.244.84.195:443

78.100.254.17:2222

85.114.99.34:443

113.170.216.154:443

194.49.79.231:443

193.3.19.37:443

84.38.133.191:443

175.110.231.67:443

191.84.204.214:995

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      1240-57-0x0000000000120000-0x0000000000142000-memory.dmp

    • Size

      136KB

    • MD5

      efb5f7159bc194e25cea0d3402da2501

    • SHA1

      8ef75319ba4186331bdcce64e586304907047857

    • SHA256

      7b4e8bdfed375e3d82a47743e185c82b5474f1358e4a78fee68d1beb4320b65c

    • SHA512

      12cd2181b09f061d9f4e1b0c1927d370cec0aa99480a73476eb2c61f1abb2cedf4ff801e368278786baf160eeac85ab813c07ceb8831f5ad18f81805dec86787

    • SSDEEP

      3072:m9NzPp1RYGqwBLLFqGAnJ0632wTBfFGQaFAy:+rvRYpwBLL8jnJd32wTB9JIF

    Score
    1/10

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks