MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc
SHA3-384 hash: e91f327b1f78c3ffda74a75550034161974ff0ab9154cc18ceb24457dac329f33d483cb5be4dce2efe3d32cc9a0255e1
SHA1 hash: d5c85a79f8afbaf828538e1544abcdf254cb2c6a
MD5 hash: 3142cbf3b97b301f787b5dfdde5e4b62
humanhash: oxygen-lithium-september-lithium
File name:186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc
Download: download sample
Signature Quakbot
Create hunting rule
File size:845'450 bytes
First seen:2021-12-14 14:43:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 1a9c25728798d3a2361b57e0b333c3a6 (1 x Quakbot)
ssdeep 12288:mNypAZnflvCNb6yzejvwP8UQw8MzcYEE:hGlMz6K8UQw8MAYEE
Threatray 422 similar samples on MalwareBazaar
TLSH T1FB05D9CC1428D31BFEBE287C6202CAF397655C431B344ABE6A63B65E24703953667D27
File icon (PE):PE icon
dhash icon 82b1ec8e92d6cc71 (6 x Gozi, 3 x Quakbot, 1 x Hancitor)
Reporter malwarelabnet
Tags:cullinan exe Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
314
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc
Verdict:
No threats detected
Analysis date:
2021-12-14 14:45:51 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/46b69980-ea5d-4179-8079-ebcb754e703c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/213958/
Detection(s):
SecuriteInfo.com.Variant.Jaik.49834.15169.17410.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a custom TCP request
Сreating synchronization primitives
Launching a process
Modifying an executable file
Searching for synchronization primitives
Creating a process with a hidden window
Creating a window
Unauthorized injection to a system process
Result
Malware family:
n/a
Score:
  0/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/1955/overview
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger overlay
Link:
https://www.filescan.io/uploads/61b8adb6db84542d41be9beb/reports/f993c5ba-2330-4049-8a87-7478143ca7f1/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/bdf007f0-14e1-4607-bb56-df8584e1b876
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc/
Threat name:
Win32.Infostealer.QBot
Create hunting rule
Status:
Malicious
First seen:
2021-12-14 14:44:13 UTC
File Type:
PE (Dll)
Extracted files:
126
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
1f29904e403ca1fb412c1e0901e1c2c386c9be53149c793c1aca1bf5835ace85
Quakbot
24a61ae809abf33396ed1e80315c7fd6a317adff261bff0994acb61d442ccb42
Quakbot
268cf4bdbb872b24825068cc75677e51941b67003a7a589963715808e9f4728a
Quakbot
3d49f30ed4cef3d532cbc73d99560d7c81db4928e8e2e81d2c83ef09196f17c1
Quakbot
a2a676d3c97975edce1e09d9f777287bc953b382962005030f7627d6da08b00a
Quakbot
e3bf20fa69644c0ca34c600feb3c43f70a1d51408534d1167825a2178a7b7073
Quakbot
+ 412 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:cullinan campaign:1639333530 banker evasion stealer trojan
Link:
https://tria.ge/reports/211214-r36bvsghbq/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
65.100.174.110:443
173.21.10.71:2222
140.82.49.12:443
190.73.3.148:2222
76.25.142.196:443
71.74.12.34:443
31.215.98.160:443
93.48.80.198:995
45.9.20.200:2211
41.228.22.180:443
109.12.111.14:443
63.143.92.99:995
120.150.218.241:995
94.60.254.81:443
86.148.6.51:443
218.101.110.3:995
216.238.71.31:443
207.246.112.221:443
216.238.72.121:443
216.238.71.31:995
207.246.112.221:995
216.238.72.121:995
186.64.87.195:443
73.151.236.31:443
78.191.12.29:995
67.165.206.193:993
68.186.192.69:443
65.100.174.110:8443
89.137.52.44:443
75.188.35.168:995
105.198.236.99:995
182.176.180.73:443
103.142.10.177:443
136.232.34.70:443
68.204.7.158:443
27.223.92.142:995
102.65.38.67:443
189.175.200.244:80
100.1.119.41:443
73.140.38.124:443
73.171.4.177:443
89.101.97.139:443
24.229.150.54:995
72.252.201.34:995
39.49.44.85:995
2.222.167.138:443
96.37.113.36:993
117.248.109.38:21
39.43.130.50:995
75.169.58.229:32100
24.55.112.61:443
27.5.4.111:2222
197.89.144.207:443
73.5.119.219:443
136.143.11.232:443
86.98.36.211:443
106.220.76.130:443
129.208.139.229:995
45.46.53.140:2222
190.229.210.128:465
91.178.126.51:995
189.18.181.24:995
185.53.147.51:443
Unpacked files
SH256 hash:
0dd5c6425e9bdda83de344a0f4abfb4247d7a68249cb9e5dba96636f7007ab33
MD5 hash:
dacbd2e14b14b2d104de7086fdbfe77a
SHA1 hash:
4701b978c503cd5a558d14ffb0aa6f582adc2337
Link:
https://www.unpac.me/results/5854c492-9836-4de9-8885-bf04cdb86cd3/
SH256 hash:
9385fd476103a349a4aef240b658d13017799a58935ee9ee24349606f874b823
MD5 hash:
342f08c9973ba9dddd67bd8b35806e75
SHA1 hash:
b5752bd55346e972c5e6c463fed59391b0fe31fc
Link:
https://www.unpac.me/results/5854c492-9836-4de9-8885-bf04cdb86cd3/
SH256 hash:
186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc
MD5 hash:
3142cbf3b97b301f787b5dfdde5e4b62
SHA1 hash:
d5c85a79f8afbaf828538e1544abcdf254cb2c6a
Link:
https://www.unpac.me/results/5854c492-9836-4de9-8885-bf04cdb86cd3/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/186b5f0acbf2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.36
Link:
https://yomi.yoroi.company/submissions/186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/213958/

Comments