MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1638a49f9b07e059d873656835beaf3b3b28cb9ee5597c6b14cb922e361225c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 3
| SHA256 hash: | 1638a49f9b07e059d873656835beaf3b3b28cb9ee5597c6b14cb922e361225c8 |
|---|---|
| SHA3-384 hash: | ac7ab4e8313b87aae2ac078a32910e845724f36bce0f80e4354501c666f200f7d970c026b0aff2807a9ea8ba90b129ca |
| SHA1 hash: | 9c08ebcbafce89881dbb38e563541745d215c9ef |
| MD5 hash: | a6cb8796ee69cda8684a8c6434ba554d |
| humanhash: | december-river-victor-oxygen |
| File name: | HU21.zip |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 1'410'656 bytes |
| First seen: | 2022-12-15 12:52:17 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| Note: | This file is a password protected archive. The password is: E17 |
| ssdeep | 24576:anZz327jIJS2Jw3z+jllN9SVhKJyxfrdD2zFeXi7LynK+wkgTIxMEoy9kdSzPj+A:Kx327gJwj+jllHSV1frdD24S7WbgbEoe |
| TLSH | T18D6533F48AB6F5F4439E8478513C2DB32E928275AD754391C20791AEFBBB884D471E23 |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  pr0xylife |
| Tags: | 1670997897 BB10 pw-E17 Qakbot Quakbot zip |
Intelligence
File Origin
# of uploads :
1
# of downloads :
120
Origin country :
LAFile Archive Information
This file is a password protected archive. The password is: E17
This file archive contains 3 file(s), sorted by their relevance:
| File name: | VV.lnk |
|---|---|
| File size: | 1'729 bytes |
| SHA256 hash: | dc33c009b7f34a22ca9731f40847335f393abd0f3fb52aec1869f7030e89ed16 |
| MD5 hash: | a3617ffc77d6880a0631a2955eee0fb8 |
| MIME type: | application/octet-stream |
| Signature | Quakbot |
| File name: | bactericide.cmd |
|---|---|
| File size: | 27 bytes |
| SHA256 hash: | 4ddb53260559a2eceb42f87d30003acc866e54e8321b91527d770637e3be1498 |
| MD5 hash: | 637a63cf76fe50fb9fea5015a30753fb |
| MIME type: | text/plain |
| Signature | Quakbot |
| File name: | scuttle.exe |
|---|---|
| File size: | 2'100'224 bytes |
| SHA256 hash: | 141d3c8278c2704ca10cbe3570679cc7a016d0bc30e106129adb38938cd47296 |
| MD5 hash: | db7007b4d5bbe4b41b75e3d39387b261 |
| MIME type: | application/x-dosexec |
| Signature | Quakbot |
Vendor Threat Intelligence
Gathering data
Result
Verdict:
UNKNOWN
Link:
Detection(s):
Suspicious file
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:bb10 campaign:1670997897 banker stealer trojan
Behaviour
Runs ping.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Qakbot/Qbot
Malware Config
C2 Extraction:
49.175.72.56:443
64.237.214.193:443
79.77.142.22:2222
173.18.126.3:443
23.242.141.218:2222
121.121.100.148:995
172.90.139.138:2222
172.248.42.122:443
94.63.65.146:443
98.145.23.67:443
12.172.173.82:990
91.68.227.219:443
12.172.173.82:993
75.99.125.236:2222
49.245.119.12:2222
74.66.134.24:443
173.239.94.212:443
91.169.12.198:32100
184.68.116.146:2222
24.71.120.191:443
103.71.21.107:443
109.11.175.42:2222
78.92.133.215:443
184.153.132.82:443
24.228.132.224:2222
69.119.123.159:2222
216.82.134.133:443
81.229.117.95:2222
92.189.214.236:2222
184.68.116.146:3389
12.172.173.82:995
73.29.92.128:443
73.230.28.7:443
150.107.231.59:2222
81.131.210.167:443
70.64.77.115:443
73.155.10.79:443
86.99.14.46:2222
86.96.75.237:2222
123.3.240.16:995
213.191.164.70:443
174.58.146.57:443
149.126.159.106:443
50.68.204.71:995
47.41.154.250:443
50.68.204.71:443
12.172.173.82:465
24.206.27.39:443
75.143.236.149:443
74.83.128.70:2083
108.6.249.139:443
79.13.202.140:443
84.35.26.14:995
70.115.104.126:995
78.247.21.20:443
188.48.116.37:995
87.65.160.87:995
71.31.101.183:443
60.234.194.12:2222
76.80.180.154:995
46.10.198.106:443
90.104.22.28:2222
72.80.7.6:995
199.83.165.233:443
80.0.74.165:443
116.74.163.218:443
86.98.23.199:443
76.100.159.250:443
76.20.42.45:443
47.34.30.133:443
70.55.120.16:2222
103.144.201.62:2078
77.86.98.236:443
2.83.12.243:443
47.203.227.114:443
178.152.126.55:443
84.113.121.103:443
108.162.6.34:443
188.176.170.61:443
50.68.204.71:993
184.176.154.83:995
92.207.132.174:2222
142.161.27.232:2222
190.29.228.61:443
176.142.207.63:443
66.191.69.18:995
90.89.95.158:2222
198.2.51.242:993
73.36.196.11:443
176.151.15.101:443
181.164.194.223:443
69.133.162.35:443
184.68.116.146:2078
136.232.184.134:995
184.68.116.146:61202
12.172.173.82:21
72.200.109.104:443
181.118.183.50:443
124.122.55.7:443
162.248.14.107:443
87.220.68.51:2222
86.225.214.138:2222
75.158.15.211:443
80.44.148.126:2222
12.172.173.82:22
75.98.154.19:443
24.142.218.202:443
70.77.116.233:443
61.69.198.59:443
184.68.116.146:50010
12.172.173.82:50001
190.24.45.24:995
94.71.209.47:2222
174.104.184.149:443
82.9.210.36:443
78.101.91.215:2222
47.149.137.40:443
64.237.214.193:443
79.77.142.22:2222
173.18.126.3:443
23.242.141.218:2222
121.121.100.148:995
172.90.139.138:2222
172.248.42.122:443
94.63.65.146:443
98.145.23.67:443
12.172.173.82:990
91.68.227.219:443
12.172.173.82:993
75.99.125.236:2222
49.245.119.12:2222
74.66.134.24:443
173.239.94.212:443
91.169.12.198:32100
184.68.116.146:2222
24.71.120.191:443
103.71.21.107:443
109.11.175.42:2222
78.92.133.215:443
184.153.132.82:443
24.228.132.224:2222
69.119.123.159:2222
216.82.134.133:443
81.229.117.95:2222
92.189.214.236:2222
184.68.116.146:3389
12.172.173.82:995
73.29.92.128:443
73.230.28.7:443
150.107.231.59:2222
81.131.210.167:443
70.64.77.115:443
73.155.10.79:443
86.99.14.46:2222
86.96.75.237:2222
123.3.240.16:995
213.191.164.70:443
174.58.146.57:443
149.126.159.106:443
50.68.204.71:995
47.41.154.250:443
50.68.204.71:443
12.172.173.82:465
24.206.27.39:443
75.143.236.149:443
74.83.128.70:2083
108.6.249.139:443
79.13.202.140:443
84.35.26.14:995
70.115.104.126:995
78.247.21.20:443
188.48.116.37:995
87.65.160.87:995
71.31.101.183:443
60.234.194.12:2222
76.80.180.154:995
46.10.198.106:443
90.104.22.28:2222
72.80.7.6:995
199.83.165.233:443
80.0.74.165:443
116.74.163.218:443
86.98.23.199:443
76.100.159.250:443
76.20.42.45:443
47.34.30.133:443
70.55.120.16:2222
103.144.201.62:2078
77.86.98.236:443
2.83.12.243:443
47.203.227.114:443
178.152.126.55:443
84.113.121.103:443
108.162.6.34:443
188.176.170.61:443
50.68.204.71:993
184.176.154.83:995
92.207.132.174:2222
142.161.27.232:2222
190.29.228.61:443
176.142.207.63:443
66.191.69.18:995
90.89.95.158:2222
198.2.51.242:993
73.36.196.11:443
176.151.15.101:443
181.164.194.223:443
69.133.162.35:443
184.68.116.146:2078
136.232.184.134:995
184.68.116.146:61202
12.172.173.82:21
72.200.109.104:443
181.118.183.50:443
124.122.55.7:443
162.248.14.107:443
87.220.68.51:2222
86.225.214.138:2222
75.158.15.211:443
80.44.148.126:2222
12.172.173.82:22
75.98.154.19:443
24.142.218.202:443
70.77.116.233:443
61.69.198.59:443
184.68.116.146:50010
12.172.173.82:50001
190.24.45.24:995
94.71.209.47:2222
174.104.184.149:443
82.9.210.36:443
78.101.91.215:2222
47.149.137.40:443
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | PassProtected_ZIP_ISO_file |
|---|---|
| Author: | _jc |
| Description: | Detects container formats commonly smuggled through password-protected zips |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
No further information available
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.