General

  • Target

    ef1c6bd0302a5d478943061929855893

  • Size

    573KB

  • Sample

    231220-vfqjnsbfg4

  • MD5

    ef1c6bd0302a5d478943061929855893

  • SHA1

    5142d65fd5a9d948585c3ea20440619a117cee44

  • SHA256

    e66df705fb259e10b0cd6fda69e5f15d0ec4989895963bc927f3da1f1723479d

  • SHA512

    20c5d739413fd968b66e95b34bc735b0b66a6517e2c08727be592ae828cd4278c1273b5c2cbe279d87cc7224668430fa0c6ea7ee17ad2b44f53dbc0ba263e50a

  • SSDEEP

    12288:387H3sH2k/e89A9tqKsuud0Hl0pT7fEztxG9HBMbVNA/irS:3Ss7/3YtqoE3MzO9HoHMs

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama107

Campaign

1633078880

C2

140.82.49.12:443

41.250.143.109:995

216.201.162.158:443

86.8.177.143:443

105.198.236.99:443

124.123.42.115:2222

217.17.56.163:443

37.210.152.224:995

190.198.206.189:2222

75.89.195.186:995

78.191.44.76:995

122.11.220.212:2222

68.186.192.69:443

159.2.51.200:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

120.151.47.189:443

47.22.148.6:443

94.200.181.154:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      ef1c6bd0302a5d478943061929855893

    • Size

      573KB

    • MD5

      ef1c6bd0302a5d478943061929855893

    • SHA1

      5142d65fd5a9d948585c3ea20440619a117cee44

    • SHA256

      e66df705fb259e10b0cd6fda69e5f15d0ec4989895963bc927f3da1f1723479d

    • SHA512

      20c5d739413fd968b66e95b34bc735b0b66a6517e2c08727be592ae828cd4278c1273b5c2cbe279d87cc7224668430fa0c6ea7ee17ad2b44f53dbc0ba263e50a

    • SSDEEP

      12288:387H3sH2k/e89A9tqKsuud0Hl0pT7fEztxG9HBMbVNA/irS:3Ss7/3YtqoE3MzO9HoHMs

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

1
T1112

Tasks