Resubmissions

21-03-2023 19:15

230321-xx84fsef4x 10

20-03-2023 14:45

230320-r4457aea57 10

20-03-2023 13:11

230320-qfc65aff5z 10

18-03-2023 21:48

230318-1nsa5aga2t 10

General

  • Target

    a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll

  • Size

    294KB

  • Sample

    230320-r4457aea57

  • MD5

    118b1050be87b8189692b82df0ae3045

  • SHA1

    f7ca1686e66866ce961a3b94bbee1d94b962a450

  • SHA256

    a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60

  • SHA512

    abe0ae20a6a7a93bdbfe2909185a646b8eae6fdf31de0a1b51f51c79bf845974345448d105cf004e91539dcb81ca6fa504db85b822599a857aeed1f1bb46e5fb

  • SSDEEP

    3072:D3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZl:jvv9sMoXBaRmr/dukbvuZ/7fH

Malware Config

Extracted

Family

qakbot

Version

401.51

Botnet

abc104

Campaign

1606818862

C2

79.119.124.237:443

87.218.53.206:2222

181.169.88.203:443

82.12.157.95:995

94.49.188.240:443

46.124.107.124:6881

86.122.248.164:2222

83.202.68.220:2222

79.129.216.215:2222

37.21.231.245:995

47.187.49.3:2222

2.90.33.130:443

149.28.98.196:995

149.28.99.97:443

45.63.107.192:995

149.28.98.196:2222

45.63.107.192:2222

74.73.27.35:443

149.28.98.196:443

144.202.38.185:2222

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60.dll

    • Size

      294KB

    • MD5

      118b1050be87b8189692b82df0ae3045

    • SHA1

      f7ca1686e66866ce961a3b94bbee1d94b962a450

    • SHA256

      a16db0d2025dff39a4a0de4071ce0e73c6810ab497453ad67c16ba0980385f60

    • SHA512

      abe0ae20a6a7a93bdbfe2909185a646b8eae6fdf31de0a1b51f51c79bf845974345448d105cf004e91539dcb81ca6fa504db85b822599a857aeed1f1bb46e5fb

    • SSDEEP

      3072:D3FMCv2QswnoiglVVcBaQFRmgLo/0S13WCCx2gXaDd3N9eCj6YmVn/XrfbZl:jvv9sMoXBaRmr/dukbvuZ/7fH

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks