General

  • Target

    5.bin

  • Size

    782KB

  • Sample

    191111-38qmrk62q2

  • MD5

    ec6d445eb2c62ff9fca2f2943d87fe89

  • SHA1

    14b1bdd79761b2a7e98d8393c6c264f92d54398f

  • SHA256

    304a01a339d86ccbba7b1f671839624d446e6ea86474912bf976837df779bad2

  • SHA512

    c5c0871a50604250c1b01dc1189e7584f300854414dd85bb03ebf9a601e1e3eb1f57e2efaae9f9602e94709653098fbcdf6ee2d847ab193a35025ccb7d721ba5

Malware Config

Extracted

Family

qakbot

Campaign

1573123220

C2

206.51.202.106:50003

173.3.132.17:995

75.131.72.82:443

68.238.144.55:443

100.4.185.8:443

5.182.39.156:443

24.201.68.105:2078

23.240.185.215:443

69.92.54.95:995

68.131.9.203:443

187.163.139.200:993

75.81.25.223:995

32.208.1.239:443

170.10.78.48:443

74.194.4.181:443

81.147.42.195:2222

71.30.56.170:443

174.16.234.171:993

66.214.75.176:443

47.153.115.154:443

Targets

    • Target

      5.bin

    • Size

      782KB

    • MD5

      ec6d445eb2c62ff9fca2f2943d87fe89

    • SHA1

      14b1bdd79761b2a7e98d8393c6c264f92d54398f

    • SHA256

      304a01a339d86ccbba7b1f671839624d446e6ea86474912bf976837df779bad2

    • SHA512

      c5c0871a50604250c1b01dc1189e7584f300854414dd85bb03ebf9a601e1e3eb1f57e2efaae9f9602e94709653098fbcdf6ee2d847ab193a35025ccb7d721ba5

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Disabling Security Tools

2
T1089

Modify Registry

3
T1112

Discovery

Remote System Discovery

1
T1018

Query Registry

3
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Tasks