General

  • Target

    uncalled.temp.dll

  • Size

    490KB

  • Sample

    221121-rcnzwscf54

  • MD5

    16382f894604507ffb636425590061f0

  • SHA1

    18c671b2c8f57e49bdc8395b5a785669c5ba25a6

  • SHA256

    af8dac9c2788cd2b5581d9e8c19b2234c6ad2ce67272cb308c72ba7035a2268e

  • SHA512

    7f1bf5516a0cf159ca67c73364cc6a660df538b0f6b16e3dc986d0c3596517396f4e24d3fb53b8f8950b9acfaddf720ac2e53e2de25373e151d8e171a1b8a9e3

  • SSDEEP

    6144:GIZQLN2lkgFJUdgAPJgwEpPWD44TITMUFOvctTWzpbTNEh6BgFJ+twd737Kn:GSlkcAPJr4WhTTiwz4agFwid7e

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

BB07

Campaign

1669024152

C2

69.119.123.159:2222

197.148.17.17:2078

174.104.184.149:443

12.172.173.82:995

91.68.227.219:443

85.241.180.94:443

83.7.53.150:443

213.22.188.57:2222

71.46.234.170:443

190.75.150.58:2222

86.98.15.100:995

89.115.196.99:443

83.31.254.67:2222

46.162.109.183:443

2.84.98.228:2222

78.69.251.252:2222

12.172.173.82:465

75.143.236.149:443

47.229.96.60:443

80.121.8.212:995

Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      uncalled.temp.dll

    • Size

      490KB

    • MD5

      16382f894604507ffb636425590061f0

    • SHA1

      18c671b2c8f57e49bdc8395b5a785669c5ba25a6

    • SHA256

      af8dac9c2788cd2b5581d9e8c19b2234c6ad2ce67272cb308c72ba7035a2268e

    • SHA512

      7f1bf5516a0cf159ca67c73364cc6a660df538b0f6b16e3dc986d0c3596517396f4e24d3fb53b8f8950b9acfaddf720ac2e53e2de25373e151d8e171a1b8a9e3

    • SSDEEP

      6144:GIZQLN2lkgFJUdgAPJgwEpPWD44TITMUFOvctTWzpbTNEh6BgFJ+twd737Kn:GSlkcAPJr4WhTTiwz4agFwid7e

MITRE ATT&CK Matrix

Tasks