MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18031a450fceb7fc4d66d734460db85af52b5a195c2338cf5aebe3aa4f11e9c4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	18031a450fceb7fc4d66d734460db85af52b5a195c2338cf5aebe3aa4f11e9c4
SHA3-384 hash:	20af2794dec8cdc109b95e2febba41e238999667520bf1906a132d3c019f175f68cc5856e1baea351066e69bc560f34e
SHA1 hash:	d4fdb5d39624de63c7918cb85fd95d303b24254c
MD5 hash:	476c4017f41ae509ce1014c1c901bdbf
humanhash:	solar-idaho-beryllium-minnesota
File name:	476c4017f41ae509ce1014c1c901bdbf.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	725'504 bytes
First seen:	2021-09-29 17:52:28 UTC
Last seen:	2021-09-29 19:06:25 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	50abbd9e7be34717c881202779a30647 (2 x Quakbot)
ssdeep	12288:tebAcis08s7gQFMWC24/MFS+AWmdnWJIjJ5F3+DpEFs3H6v/+ZoTN:tMDis0dFA24/MFSptIJKnx+NE23a3+ZS
Threatray	181 similar samples on MalwareBazaar
TLSH	T1C2F47C403A55E521E6BC1A328F2AD5E807187D089FB5B4DF79E03F1F2AB98D3C621316
Reporter	abuse_ch
Tags:	dll obama106 Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

287

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/193250/

Detection(s):

SecuriteInfo.com.Trojan.Inject4.16721.22832.29900.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Malware family:

Qakbot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ffa1e385-cec1-4096-9b03-7e219823e1fa

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/18031a450fceb7fc4d66d734460db85af52b5a195c2338cf5aebe3aa4f11e9c4/

Threat name:

Win32.Infostealer.Convagent

Status:

Malicious

First seen:

2021-09-29 17:53:05 UTC

AV detection:

4 of 45 (8.89%)

Threat level:

5/5

Verdict:

malicious

Label(s):

qakbot

gozi

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:obama106 campaign:1632905607 banker evasion stealer trojan

Link:

https://tria.ge/reports/210929-wgaqaafeej/

Behaviour

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Qakbot/Qbot

Windows security bypass

Malware Config

C2 Extraction:

37.210.152.224:995
120.151.47.189:443
105.198.236.99:443
122.11.220.212:2222
199.27.127.129:443
41.251.41.14:995
216.201.162.158:443
124.123.42.115:2078
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
217.17.56.163:443
182.181.78.18:995
140.82.49.12:443
105.159.144.186:995
89.101.97.139:443
217.17.56.163:0
27.223.92.142:995
95.77.223.148:443
109.190.253.11:2222
81.250.153.227:2222
190.198.206.189:2222
81.241.252.59:2078
136.232.34.70:443
47.22.148.6:443
93.8.66.216:443
124.123.42.115:2222
217.17.56.163:2222
217.17.56.163:2078
217.17.56.163:465
41.228.22.180:443
76.25.142.196:443
71.74.12.34:443
71.80.168.245:443
75.188.35.168:443
173.21.10.71:2222
73.151.236.31:443
45.46.53.140:2222
67.165.206.193:993
38.10.201.211:443
72.252.201.69:443
71.60.246.5:443
92.148.59.207:2222
92.157.171.41:2222
24.139.72.117:443
186.18.205.199:995
24.229.150.54:995
47.40.196.233:2222
24.55.112.61:443
177.130.82.197:2222
109.12.111.14:443
68.204.7.158:443
186.87.135.68:995
80.6.192.58:443
103.148.120.144:443
75.66.88.33:443
173.25.166.81:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.108.147:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443