General

  • Target

    30cacfc6230d9ec947d3d615c6478372_JaffaCakes118

  • Size

    573KB

  • Sample

    240709-r3br9azgmh

  • MD5

    30cacfc6230d9ec947d3d615c6478372

  • SHA1

    f97b0a8970e2244f67c76cb827f5d4225745b851

  • SHA256

    f7f765c377da143fde9e73afebaa1da774f8b045a3f15f7cb4a4811f5d8e2ccd

  • SHA512

    4add3dba0df12a818361c6d02213fdfa9684a97ed5a626d4b5ecbf5777253c74385168b3324e110929b082698e6d42b7e0791aa1be96aa33fa0e00711d17625a

  • SSDEEP

    12288:A87H3sH2k/eF9A9tqKsuud0fl0pT7fEztxG9HBMbVNAPirS:ASs7/2YtqIE3MzO9HoHMs

Malware Config

Extracted

Family

qakbot

Version

402.363

Botnet

obama107

Campaign

1633078880

C2

140.82.49.12:443

41.250.143.109:995

216.201.162.158:443

86.8.177.143:443

105.198.236.99:443

124.123.42.115:2222

217.17.56.163:443

37.210.152.224:995

190.198.206.189:2222

75.89.195.186:995

78.191.44.76:995

122.11.220.212:2222

68.186.192.69:443

159.2.51.200:2222

217.17.56.163:2222

217.17.56.163:2078

41.228.22.180:443

120.151.47.189:443

47.22.148.6:443

94.200.181.154:443

Attributes
  • salt

    jHxastDcds)oMc=jvh7wdUhxcsdt2

Targets

    • Target

      30cacfc6230d9ec947d3d615c6478372_JaffaCakes118

    • Size

      573KB

    • MD5

      30cacfc6230d9ec947d3d615c6478372

    • SHA1

      f97b0a8970e2244f67c76cb827f5d4225745b851

    • SHA256

      f7f765c377da143fde9e73afebaa1da774f8b045a3f15f7cb4a4811f5d8e2ccd

    • SHA512

      4add3dba0df12a818361c6d02213fdfa9684a97ed5a626d4b5ecbf5777253c74385168b3324e110929b082698e6d42b7e0791aa1be96aa33fa0e00711d17625a

    • SSDEEP

      12288:A87H3sH2k/eF9A9tqKsuud0fl0pT7fEztxG9HBMbVNAPirS:ASs7/2YtqIE3MzO9HoHMs

MITRE ATT&CK Matrix ATT&CK v13

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

1
T1112

Tasks