MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d1850712e82653dc7112d8bdae533b898a68f696c9b66dfe8f93120f73af191. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 8

Intelligence 8 IOCs YARA File information Comments

SHA256 hash:	0d1850712e82653dc7112d8bdae533b898a68f696c9b66dfe8f93120f73af191
SHA3-384 hash:	2a358531ca5af753628966561c251305010b7fc9686470f588a5544166c263149b3ebe8c2b001db5e2742b201ec3e95a
SHA1 hash:	5f9ac387582bba19f2bc351aaa6bdcee129f25f8
MD5 hash:	485818421ba8f61c374f86d4e8cdf0b1
humanhash:	saturn-shade-music-pasta
File name:	485818421ba8f61c374f86d4e8cdf0b1.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	725'504 bytes
First seen:	2021-09-30 05:52:43 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	3a9ce6dbfabfc6032e0cfde571419746 (4 x Quakbot)
ssdeep	12288:2EbAcis08s7gQFMWC24/MFS+AWmdXWJIjJ5F3+DpEFs3H6v/+JoTN:22Dis0dFA24/MFSptoJKnx+NE23a3+JS
Threatray	185 similar samples on MalwareBazaar
TLSH	T134F47C403A55E521E6BD1A328F2AD5E807187D089FB5B4DF79E03F1F2AB98D3C621316
Reporter	abuse_ch
Tags:	dll obama106 Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

250

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/193337/

Detection(s):

SecuriteInfo.com.Trojan.Inject4.16721.1919.25074.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Malware family:

Qakbot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/fbb070e0-462e-43c3-8129-f59984cde9ff

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0d1850712e82653dc7112d8bdae533b898a68f696c9b66dfe8f93120f73af191/

Threat name:

Win32.Infostealer.Convagent

Status:

Malicious

First seen:

2021-09-29 18:36:53 UTC

AV detection:

6 of 45 (13.33%)

Threat level:

5/5

Verdict:

malicious

Label(s):

qakbot

gozi

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:obama106 campaign:1632905607 banker evasion stealer trojan

Link:

https://tria.ge/reports/210930-gla5aageg7/

Behaviour

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Qakbot/Qbot

Windows security bypass

Malware Config

C2 Extraction:

37.210.152.224:995
120.151.47.189:443
105.198.236.99:443
122.11.220.212:2222
199.27.127.129:443
41.251.41.14:995
216.201.162.158:443
124.123.42.115:2078
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
217.17.56.163:443
182.181.78.18:995
140.82.49.12:443
105.159.144.186:995
89.101.97.139:443
217.17.56.163:0
27.223.92.142:995
95.77.223.148:443
109.190.253.11:2222
81.250.153.227:2222
190.198.206.189:2222
81.241.252.59:2078
136.232.34.70:443
47.22.148.6:443
93.8.66.216:443
124.123.42.115:2222
217.17.56.163:2222
217.17.56.163:2078
217.17.56.163:465
41.228.22.180:443
76.25.142.196:443
71.74.12.34:443
71.80.168.245:443
75.188.35.168:443
173.21.10.71:2222
73.151.236.31:443
45.46.53.140:2222
67.165.206.193:993
38.10.201.211:443
72.252.201.69:443
71.60.246.5:443
92.148.59.207:2222
92.157.171.41:2222
24.139.72.117:443
186.18.205.199:995
24.229.150.54:995
47.40.196.233:2222
24.55.112.61:443
177.130.82.197:2222
109.12.111.14:443
68.204.7.158:443
186.87.135.68:995
80.6.192.58:443
103.148.120.144:443
75.66.88.33:443
173.25.166.81:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.108.147:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443