General

  • Target

    c38e202b9987a0ae6836cf08d74e6e5f

  • Size

    1.0MB

  • Sample

    231220-rj57rageaq

  • MD5

    c38e202b9987a0ae6836cf08d74e6e5f

  • SHA1

    b34714e2e3b11035c21db0f24a3968e4b5d7bf5e

  • SHA256

    13683e932349de3e5884bf4aa703ad3337a122864903b50cd00d8848a6d8cc8f

  • SHA512

    b5f04d84805e51b5a76ff5b52a82de13a772a6259006c853db0e1962f22bf561bf808f8d08f2863a9f85481a00fa29841a68a97a691c6bcd4b950be1ae6675c0

  • SSDEEP

    24576:Dgc9GxisYespQ90K5W44ZKtqcuALNLJ2PJgrUsROmbvbfgkqKhRwdkq11Jg:0isYxpg0vxgtqcuABLJ2PiIsROmjbfg4

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama109

Campaign

1633422349

C2

202.134.178.157:443

187.116.124.82:995

73.130.180.25:443

73.52.50.32:443

120.151.47.189:443

181.118.183.94:443

122.11.220.212:2222

103.142.10.177:443

202.165.32.158:2222

70.37.217.196:443

78.191.36.142:995

167.248.100.227:443

103.148.120.144:443

89.101.97.139:443

75.75.179.226:443

120.150.218.241:995

185.250.148.74:443

72.196.22.184:0

81.241.252.59:2078

140.82.49.12:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      c38e202b9987a0ae6836cf08d74e6e5f

    • Size

      1.0MB

    • MD5

      c38e202b9987a0ae6836cf08d74e6e5f

    • SHA1

      b34714e2e3b11035c21db0f24a3968e4b5d7bf5e

    • SHA256

      13683e932349de3e5884bf4aa703ad3337a122864903b50cd00d8848a6d8cc8f

    • SHA512

      b5f04d84805e51b5a76ff5b52a82de13a772a6259006c853db0e1962f22bf561bf808f8d08f2863a9f85481a00fa29841a68a97a691c6bcd4b950be1ae6675c0

    • SSDEEP

      24576:Dgc9GxisYespQ90K5W44ZKtqcuALNLJ2PJgrUsROmbvbfgkqKhRwdkq11Jg:0isYxpg0vxgtqcuABLJ2PiIsROmjbfg4

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Tasks