General

  • Target

    1944-58-0x0000000000230000-0x0000000000259000-memory.dmp

  • Size

    164KB

  • Sample

    221026-xv7slsggan

  • MD5

    3be0732c725535b10ef7fcc0b07c5431

  • SHA1

    53bae475fc35c9ada685b3204455a212c4c2e098

  • SHA256

    96fd316fd27ee0202036ff4b1d813ec783693a205c85b60cf5988b33d98956a3

  • SHA512

    98d2ba8688751f4a767d0b0dd22caa2998a48ff43e44b5aebe9e51079a3c83226edf9461686ed988637f49d587fcc8472748685d8acb0ee3449b88137b3c2e0f

  • SSDEEP

    3072:QmcIPgnL0VAO7ARJJ4diHTBfV3yHvO/ya:uIonL0ZsRJWdiHTBNiH2/

Malware Config

Extracted

Family

qakbot

Version

403.1051

Botnet

obama217

Campaign

1666765529

C2

197.204.53.242:443

105.106.60.149:443

102.159.110.79:995

64.207.237.118:443

156.216.134.70:995

180.151.116.67:443

190.199.97.108:993

206.1.203.0:443

186.188.96.197:443

206.1.128.203:443

201.249.100.208:995

190.75.151.66:2222

198.2.51.242:993

90.165.109.4:2222

71.199.168.185:443

181.56.171.3:995

43.241.159.148:443

41.103.1.16:443

24.207.97.117:443

105.157.86.118:443

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      1944-58-0x0000000000230000-0x0000000000259000-memory.dmp

    • Size

      164KB

    • MD5

      3be0732c725535b10ef7fcc0b07c5431

    • SHA1

      53bae475fc35c9ada685b3204455a212c4c2e098

    • SHA256

      96fd316fd27ee0202036ff4b1d813ec783693a205c85b60cf5988b33d98956a3

    • SHA512

      98d2ba8688751f4a767d0b0dd22caa2998a48ff43e44b5aebe9e51079a3c83226edf9461686ed988637f49d587fcc8472748685d8acb0ee3449b88137b3c2e0f

    • SSDEEP

      3072:QmcIPgnL0VAO7ARJJ4diHTBfV3yHvO/ya:uIonL0ZsRJWdiHTBNiH2/

    Score
    1/10

MITRE ATT&CK Matrix ATT&CK v6

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks