General

  • Target

    verify.temp

  • Size

    374KB

  • Sample

    221124-x6mltaea63

  • MD5

    825aa87ffbc7e0e064088c051b5fbc14

  • SHA1

    eeee61f8e50b036ce6ad393444645c66395e719f

  • SHA256

    cc1b453ef566a77c6fb1739e8654789214870e97ee742044c9d0ce76032b283a

  • SHA512

    1c24da6d0c8a783b9982a12c276e090d8d9efe3188c593f847d2bdc2e047c0635770aa5dc6c904b0e03063b3b59746d7e44b28824bb056d7429baf8210ba7af2

Malware Config

Extracted

Family

qakbot

Version

404.30

Botnet

obama223

Campaign

1668757345

C2

68.47.128.161:443

87.65.160.87:995

172.90.139.138:2222

86.175.128.143:443

12.172.173.82:465

71.247.10.63:2083

47.41.154.250:443

91.254.215.167:443

71.31.101.183:443

81.229.117.95:2222

24.4.239.157:443

41.99.177.175:443

92.149.205.238:2222

73.230.28.7:443

47.229.96.60:443

186.188.2.193:443

174.112.25.29:2078

84.35.26.14:995

86.130.9.167:2222

116.74.163.221:443

Attributes
salt
SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Targets

    • Target

      verify.temp

    • Size

      374KB

    • MD5

      825aa87ffbc7e0e064088c051b5fbc14

    • SHA1

      eeee61f8e50b036ce6ad393444645c66395e719f

    • SHA256

      cc1b453ef566a77c6fb1739e8654789214870e97ee742044c9d0ce76032b283a

    • SHA512

      1c24da6d0c8a783b9982a12c276e090d8d9efe3188c593f847d2bdc2e047c0635770aa5dc6c904b0e03063b3b59746d7e44b28824bb056d7429baf8210ba7af2

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Discovery

            Execution

              Exfiltration

                Impact

                  Initial Access

                    Lateral Movement

                      Persistence

                        Privilege Escalation