MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2c9a1589ddb6fb301b4900816e51faf0cde4d90148e1c233d25862be62bb2dd8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 4
| SHA256 hash: | 2c9a1589ddb6fb301b4900816e51faf0cde4d90148e1c233d25862be62bb2dd8 |
|---|---|
| SHA3-384 hash: | df07aabed0d42384b932f82550b6223b46ced12d90ddf8fa5c1fea2d20c73c0d13721956ca83dcd33205a5f799666920 |
| SHA1 hash: | 492a1b86169a88041df70f0e930be1478c6dd278 |
| MD5 hash: | 75e5c2e7e3a6091cada07d9eba405b0e |
| humanhash: | mike-undress-oven-lion |
| File name: | LN12.zip |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 357'692 bytes |
| First seen: | 2022-12-06 12:48:55 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| Note: | This file is a password protected archive. The password is: U12 |
| ssdeep | 6144:Fe5ls62fggxdvbJ1jTCmZzabGAjyyejdndKcjBgiMdpUXZp5kBxEhvyhx3tkIef:Fe5yRvbD/zUZReBnUdKwNx37o |
| TLSH | T1F37423CE1329CF4D7557F6A3822596FDDB86B1267C9D9A83718FF60383A0168584C28F |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  pr0xylife |
| Tags: | 1670354428 BB09 pw-U12 Qakbot Quakbot zip |
Intelligence
File Origin
# of uploads :
1
# of downloads :
155
Origin country :
RUFile Archive Information
This file is a password protected archive. The password is: U12
This file archive contains 7 file(s), sorted by their relevance:
| File name: | string.txt |
|---|---|
| File size: | 6'246 bytes |
| SHA256 hash: | 5f7b42180700d2fe54259a5711fdcb0b8f41501082fbfe9b5f943e7d506534d4 |
| MD5 hash: | 59fd41076f71415602167a07d33c866c |
| MIME type: | application/octet-stream |
| Signature | Quakbot |
| File name: | mynah.cmd |
|---|---|
| File size: | 299 bytes |
| SHA256 hash: | f861ae19db7fb3de597e5bb2fa83fc387cda06108461b805bda8025849e04fff |
| MD5 hash: | da182f2f18108a219f8ef565e54868e6 |
| MIME type: | text/plain |
| Signature | Quakbot |
| File name: | 2 |
|---|---|
| File size: | 323 bytes |
| SHA256 hash: | 6f88bc7cb02ccb2dbc26b5f4ce53e355b331e31bb920b2ba8cbbcd1b5d4cd5a0 |
| MD5 hash: | 9ce8c70178061cc4cf4a6bb1e291df93 |
| MIME type: | text/xml |
| Signature | Quakbot |
| File name: | annotates.cmd |
|---|---|
| File size: | 223 bytes |
| SHA256 hash: | de7185b7f45cfb591af1faf2496ae7498fc971b3fa6eb4c92bd0d0ffd1cc209e |
| MD5 hash: | 9bb9812540b83f5cfd7cdf25633f0426 |
| MIME type: | text/plain |
| Signature | Quakbot |
| File name: | WPSettings.dat |
|---|---|
| File size: | 12 bytes |
| SHA256 hash: | 35493e7cb2945033dcf8efab4dcce70101ca32fdf27296e2c67f84f2f957c20b |
| MD5 hash: | 956d99a9a3ec093964503806711ca36b |
| MIME type: | application/octet-stream |
| Signature | Quakbot |
| File name: | forthcoming.tmp |
|---|---|
| File size: | 613'376 bytes |
| SHA256 hash: | c22fee368833ff4303e6b563fe540c7759f2f4ff0102f3cb8867b30d1be5dda4 |
| MD5 hash: | 80a27842055378bd905a43aca1907425 |
| MIME type: | application/x-dosexec |
| Signature | Quakbot |
| File name: | DS.lnk |
|---|---|
| File size: | 1'713 bytes |
| SHA256 hash: | 3bdef21db3c0e1843d03a5458cc0f4c09bd9a06e2bc836ffab0731da0b49104f |
| MD5 hash: | 4091d7118195b7b04cfe0e883bb8d0b8 |
| MIME type: | application/octet-stream |
| Signature | Quakbot |
Vendor Threat Intelligence
Gathering data
Result
Verdict:
UNKNOWN
Link:
Threat name:
Binary.Trojan.Generic
Status:
Suspicious
First seen:
2022-12-06 12:49:06 UTC
File Type:
Binary (Archive)
AV detection:
3 of 39 (7.69%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:bb09 campaign:1670354428 banker stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Qakbot/Qbot
Malware Config
C2 Extraction:
216.82.134.218:443
49.175.72.56:443
12.172.173.82:22
12.172.173.82:50001
190.24.45.24:995
103.144.201.62:2078
24.142.218.202:443
70.160.80.210:443
24.228.132.224:2222
117.186.222.30:993
173.18.126.3:443
75.99.125.235:2222
172.90.139.138:2222
136.232.184.134:995
123.3.240.16:995
76.100.159.250:443
66.191.69.18:995
181.118.183.44:443
31.167.254.199:995
183.82.100.110:2222
83.92.85.93:443
91.169.12.198:32100
24.64.114.59:2222
74.66.134.24:443
78.69.251.252:2222
91.68.227.219:443
12.172.173.82:993
24.177.111.153:443
85.7.61.22:2222
70.181.149.227:443
173.239.94.212:443
92.24.200.226:995
104.152.223.133:443
80.13.179.151:2222
69.119.123.159:2222
70.95.236.129:443
64.121.161.102:443
70.115.104.126:995
12.172.173.82:995
221.161.103.6:443
66.131.25.6:443
200.109.14.93:2222
213.91.235.146:443
76.80.180.154:995
2.83.12.243:443
81.248.77.37:2222
12.172.173.82:465
70.64.77.115:443
75.143.236.149:443
81.229.117.95:2222
75.98.154.19:443
121.122.99.223:995
47.34.30.133:443
92.189.214.236:2222
216.196.245.102:2083
136.244.25.165:443
188.48.123.229:995
90.104.22.28:2222
204.210.210.7:443
78.92.133.215:443
47.41.154.250:443
50.68.204.71:995
65.30.139.145:995
71.247.10.63:995
58.162.223.233:443
50.68.204.71:443
73.161.176.218:443
58.247.115.126:995
199.83.165.233:443
98.145.23.67:443
84.35.26.14:995
24.64.114.59:3389
149.126.159.106:443
116.74.164.2:443
24.206.27.39:443
12.172.173.82:21
77.86.98.236:443
50.68.204.71:993
190.206.70.80:2222
41.44.19.36:995
137.186.193.226:3389
139.216.164.122:443
184.176.154.83:995
92.207.132.174:2222
142.161.27.232:2222
73.155.10.79:443
176.142.207.63:443
103.55.67.180:443
184.153.132.82:443
76.20.42.45:443
174.104.184.149:443
108.6.249.139:443
69.133.162.35:443
198.2.51.242:993
184.101.163.128:443
70.77.116.233:443
24.64.114.59:61202
66.176.250.180:443
75.158.15.211:443
181.164.194.228:443
72.200.109.104:443
174.101.111.4:443
86.225.214.138:2222
86.98.23.199:443
84.113.121.103:443
86.96.75.237:2222
162.248.14.107:443
90.89.95.158:2222
80.0.74.165:443
73.36.196.11:443
27.32.171.38:443
176.151.15.101:443
87.65.160.87:995
78.247.21.20:443
24.64.114.59:2078
74.93.148.97:995
82.9.210.36:443
49.175.72.56:443
12.172.173.82:22
12.172.173.82:50001
190.24.45.24:995
103.144.201.62:2078
24.142.218.202:443
70.160.80.210:443
24.228.132.224:2222
117.186.222.30:993
173.18.126.3:443
75.99.125.235:2222
172.90.139.138:2222
136.232.184.134:995
123.3.240.16:995
76.100.159.250:443
66.191.69.18:995
181.118.183.44:443
31.167.254.199:995
183.82.100.110:2222
83.92.85.93:443
91.169.12.198:32100
24.64.114.59:2222
74.66.134.24:443
78.69.251.252:2222
91.68.227.219:443
12.172.173.82:993
24.177.111.153:443
85.7.61.22:2222
70.181.149.227:443
173.239.94.212:443
92.24.200.226:995
104.152.223.133:443
80.13.179.151:2222
69.119.123.159:2222
70.95.236.129:443
64.121.161.102:443
70.115.104.126:995
12.172.173.82:995
221.161.103.6:443
66.131.25.6:443
200.109.14.93:2222
213.91.235.146:443
76.80.180.154:995
2.83.12.243:443
81.248.77.37:2222
12.172.173.82:465
70.64.77.115:443
75.143.236.149:443
81.229.117.95:2222
75.98.154.19:443
121.122.99.223:995
47.34.30.133:443
92.189.214.236:2222
216.196.245.102:2083
136.244.25.165:443
188.48.123.229:995
90.104.22.28:2222
204.210.210.7:443
78.92.133.215:443
47.41.154.250:443
50.68.204.71:995
65.30.139.145:995
71.247.10.63:995
58.162.223.233:443
50.68.204.71:443
73.161.176.218:443
58.247.115.126:995
199.83.165.233:443
98.145.23.67:443
84.35.26.14:995
24.64.114.59:3389
149.126.159.106:443
116.74.164.2:443
24.206.27.39:443
12.172.173.82:21
77.86.98.236:443
50.68.204.71:993
190.206.70.80:2222
41.44.19.36:995
137.186.193.226:3389
139.216.164.122:443
184.176.154.83:995
92.207.132.174:2222
142.161.27.232:2222
73.155.10.79:443
176.142.207.63:443
103.55.67.180:443
184.153.132.82:443
76.20.42.45:443
174.104.184.149:443
108.6.249.139:443
69.133.162.35:443
198.2.51.242:993
184.101.163.128:443
70.77.116.233:443
24.64.114.59:61202
66.176.250.180:443
75.158.15.211:443
181.164.194.228:443
72.200.109.104:443
174.101.111.4:443
86.225.214.138:2222
86.98.23.199:443
84.113.121.103:443
86.96.75.237:2222
162.248.14.107:443
90.89.95.158:2222
80.0.74.165:443
73.36.196.11:443
27.32.171.38:443
176.151.15.101:443
87.65.160.87:995
78.247.21.20:443
24.64.114.59:2078
74.93.148.97:995
82.9.210.36:443
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | cobalt_strike_tmp01925d3f |
|---|---|
| Author: | The DFIR Report |
| Description: | files - file ~tmp01925d3f.exe |
| Reference: | https://thedfirreport.com |
| Rule name: | PassProtected_ZIP_ISO_file |
|---|---|
| Author: | _jc |
| Description: | Detects container formats commonly smuggled through password-protected zips |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Quakbot
zip 2c9a1589ddb6fb301b4900816e51faf0cde4d90148e1c233d25862be62bb2dd8
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.