MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1e6babc47a7fc33ca883adfc5165c6597fe1b60f04b08cfeec78055c37e05c7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1e6babc47a7fc33ca883adfc5165c6597fe1b60f04b08cfeec78055c37e05c7b
SHA3-384 hash: 29885061c81498dd9d3c946985c7379b4f50c1ed0bce56c5e27d4680e4983ec8682fe8a95c468f09c4eaabe29e02fef8
SHA1 hash: 591276bea72991b2ab958b594376fd0d47a40876
MD5 hash: df3cbb35cd0f3424f37765c6626bdbf1
humanhash: timing-speaker-triple-eleven
File name:1e6babc47a7fc33ca883adfc5165c6597fe1b60f04b08cfeec78055c37e05c7b
Download: download sample
Signature Quakbot
Create hunting rule
File size:969'328 bytes
First seen:2022-03-10 14:05:47 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 4be20c1d0cff08001af7f6da02464dc6 (9 x Quakbot)
ssdeep 24576:X9t3O1k4YwdH9CZ4nJ/TwiuPi6U2SAHl4XoWSIgX4Tw:X9n4RJlLLKKgX4T
Threatray 168 similar samples on MalwareBazaar
TLSH T165259D63E3D0487EC16A2B399D2B576898B96A113D24F4C63AE41C8C5F3764376273E3
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter malwarelabnet
Tags:AA dll Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/249168/
Detection(s):
Win.Malware.Qakbot-9940971-1
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
control.exe keylogger overlay packed
Link:
https://www.filescan.io/uploads/622a05cf0cd58dbd9276c27d/reports/46b0eda1-1b39-4f2b-8516-3195543251b3/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/557493fc-d5ca-4658-9939-39e07e94d8a3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1e6babc47a7fc33ca883adfc5165c6597fe1b60f04b08cfeec78055c37e05c7b/
Threat name:
Win32.Trojan.KBot
Create hunting rule
Status:
Malicious
First seen:
2022-03-10 14:06:13 UTC
File Type:
PE (Dll)
Extracted files:
40
AV detection:
24 of 27 (88.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dzv2xrd2p7btzkedvx6fczoglf76dnqpasyiz7xmpacvyn7alr5q._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
11e04e06de6279a383da18618f0f174e03e4e06b28555093188f331d1c2fd597
Quakbot
2038276cab6905cb3334825ca34e9417d520566b78f31e706336d092be8ccc7a
Quakbot
4192d813df909928d3b83a040a14992bc38ac2890d22f3952bfcd164236c7ef8
Quakbot
41e063c24b12f07351c04b48bc566ce98c501d24f500d13d127f94f0d0545c6c
Quakbot
5daf4d0f896727963587153c42714e51439996b9a6ac190f1b749c0e25d22487
Quakbot
8b129abec1a7ece64cf97e84552285eba90ad5f37f79d4460a320f66f5de1ed7
Quakbot
9ae6784aacb19be546ba5e1f1bb44882e8f9c8f692472947d2734afcd7d54e05
Quakbot
a8a1e59e5bb04ac6e7c422a105a6816bc0e1c6755b7902bc670d1cf2bcbeca53
Quakbot
c71a24c7ecc4fc745cdd9bcc602c6995113a19221abbacce72df070b6b2052f8
Quakbot
cdd76708c7f99f29ba010696a7415a277a076c6f791b603a8b4001230d371930
Quakbot
+ 158 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:aa campaign:1646840852 banker stealer trojan
Link:
https://tria.ge/reports/220310-red8gaagak/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Qakbot/Qbot
Malware Config
C2 Extraction:
82.152.39.39:443
91.177.173.10:995
140.82.49.12:443
176.67.56.94:443
47.180.172.159:443
75.99.168.194:443
140.82.63.183:443
140.82.63.183:995
181.118.183.94:443
2.50.27.78:443
41.230.62.211:993
24.43.99.75:443
217.165.79.31:443
24.178.196.158:2222
189.253.32.61:995
197.37.66.133:995
173.174.216.62:443
47.23.89.61:995
47.23.89.61:993
173.21.10.71:2222
191.112.19.94:443
196.203.37.215:80
69.159.200.138:2222
39.44.188.102:995
136.143.11.232:443
41.84.244.32:995
89.101.97.139:443
71.13.93.154:2222
176.57.126.138:443
75.99.168.194:61201
100.1.108.246:443
83.110.75.83:995
217.165.79.31:995
208.107.221.224:443
173.170.224.168:995
63.143.92.99:995
70.57.207.83:443
72.12.115.90:22
72.252.201.34:995
70.51.139.58:2222
114.79.148.170:443
103.139.242.30:990
80.11.74.81:2222
83.110.153.238:61200
139.64.13.51:995
70.46.220.114:443
72.252.201.34:990
144.202.2.175:995
190.189.33.6:32101
182.191.92.203:995
93.48.80.198:995
31.35.28.29:443
39.49.53.23:995
40.134.247.125:995
75.159.9.236:443
176.45.218.254:995
38.70.253.226:2222
92.99.229.158:2222
78.100.194.196:6883
96.246.158.154:995
89.211.187.132:2222
197.164.168.41:993
86.97.209.134:1194
76.70.9.169:2222
183.82.103.213:443
208.101.87.135:443
120.150.218.241:995
67.209.195.198:443
217.128.122.65:2222
197.237.74.185:995
79.167.199.210:995
45.9.20.200:443
96.21.251.127:2222
92.177.45.46:2078
206.217.0.154:995
186.10.247.110:443
172.114.160.81:995
209.210.95.228:32100
1.161.97.158:443
74.15.2.252:2222
78.169.100.120:443
105.186.100.243:995
41.228.22.180:443
63.153.150.20:443
70.163.1.219:443
86.195.158.178:2222
103.87.95.131:2222
72.76.94.99:443
190.73.3.148:2222
108.4.67.252:443
84.241.8.23:32103
24.55.67.176:443
80.14.188.219:2222
207.170.238.231:443
217.128.93.27:2222
149.28.238.199:443
45.63.1.12:995
144.202.3.39:995
144.202.3.39:443
45.76.167.26:995
45.63.1.12:443
45.76.167.26:443
144.202.2.175:443
149.28.238.199:995
117.248.109.38:21
197.89.21.109:443
89.86.33.217:443
120.61.3.163:443
86.98.11.110:443
217.165.85.106:993
5.95.58.211:2087
41.130.133.118:995
81.229.130.188:443
124.41.193.166:443
119.158.105.8:995
102.140.70.62:443
176.253.27.51:443
1.161.97.158:995
103.139.242.30:993
175.145.235.37:443
183.88.63.73:2222
128.106.122.181:443
39.52.62.239:995
76.25.142.196:443
32.221.225.247:443
121.74.187.191:995
86.98.48.115:995
71.74.12.34:443
189.146.51.56:443
191.99.191.28:443
73.151.236.31:443
216.10.217.114:443
76.169.147.192:32103
47.180.172.159:50010
187.170.7.81:443
47.156.191.217:443
201.170.181.247:443
5.32.41.45:443
172.114.160.81:443
68.204.7.158:443
105.187.31.228:995
187.59.18.65:443
31.215.70.101:443
109.12.111.14:443
41.84.246.125:443
83.110.218.135:32101
118.189.242.45:2083
39.52.217.44:995
89.137.52.44:443
217.164.120.130:2222
Unpacked files
SH256 hash:
f7f8e61980465510c8d0f0a46acd69e6b7aef9e526b048e43c49fa9dfa6351ee
MD5 hash:
de08d3013bb055ae8fd6311b24753322
SHA1 hash:
a913bc7b2f4ca8d1dbcf8a85b35d30d6fe2631e0
Link:
https://www.unpac.me/results/1bdf7673-7481-459f-ac0f-ea9d05bdf50b/
SH256 hash:
5ba45432b9d6a4875c61ba9d44bde9bd10b974d5388bc0abe9ae9dfccfce7e56
MD5 hash:
98a0c7716dd4e393f3825761df54564b
SHA1 hash:
20a03b6c2b140151e04e2cdfce21bef04f228f75
Link:
https://www.unpac.me/results/1bdf7673-7481-459f-ac0f-ea9d05bdf50b/
SH256 hash:
1e6babc47a7fc33ca883adfc5165c6597fe1b60f04b08cfeec78055c37e05c7b
MD5 hash:
df3cbb35cd0f3424f37765c6626bdbf1
SHA1 hash:
591276bea72991b2ab958b594376fd0d47a40876
Link:
https://www.unpac.me/results/1bdf7673-7481-459f-ac0f-ea9d05bdf50b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1e6babc47a7fc33ca883adfc5165c6597fe1b60f04b08cfeec78055c37e05c7b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/249168/

Comments