MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da
SHA3-384 hash: 404b2bcf350ef433e9abf9a15e6cd32f3e7f9f0389d1ccb93144ad3d0d5a1155ddd96daafb447abfc4397e0c3bc0084d
SHA1 hash: 17aa4ce85e931fdf383b864144a3c1b6e68f91e2
MD5 hash: 97406f2cee93cdb660848c99e6d291e6
humanhash: maine-berlin-quiet-johnny
File name:test.test
Download: download sample
Signature Quakbot
Create hunting rule
File size:853'287 bytes
First seen:2021-09-27 13:10:09 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 707b685fcd373f41f25f8233f81e5f84 (2 x Quakbot)
ssdeep 12288:gqecJ1QmY0T8mu7KV27AdaZGNwlMncPX7YMQaGlnQ:gxMIp73U4k7cPLqaGtQ
Threatray 160 similar samples on MalwareBazaar
TLSH T13505E129BFD7E424C43D457989E1D8E2223DBC556C14C90B3AC97F3F2DB70812E9A16A
Reporter ffforward
Tags:dll Qakbot qbot Quakbot test tr

Intelligence

File Origin
# of uploads :
1
# of downloads :
262
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/192096/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1e8b7db7-9ff6-4371-b6e8-dbdb76a93785
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da/
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
gozi
Create hunting rule
Similar samples:
095c41270ae3a26ae9efb626be12ed920c44432f3c8cc8ed8ee67d67425c1251
Quakbot
1b1ddb8520b8cd70023535854bfe614f99e001d69b22f5bc6890137262cefb0a
Quakbot
2915591ef479332f179e26a3f6e4a63c35049569f5ca42d067f64dbdae681df9
Quakbot
5196c35f3e7a88038805a3da1632baca040a08c2dc391e2e5c416cf11e4e915c
Quakbot
5b0bf4defd88befa231c4ebe655ae860b180baa8e0331cd6c570d31f6751b9bd
Quakbot
5d8f270f7b1d814d0e218381e129e808960350c181da47cd1e9ca9ac18acd842
Quakbot
6597115cdbfcefaddf4c268c43c705077fc0d0079a65ffa972e1c096451385e5
Quakbot
751483305378ddd40bc1c640265e95f41d02b4b739a5c17188ad51ecc0679213
Quakbot
7661002966c0c3621224d0c2618488393471ab9c72cd6e1f7592cc49163f23d7
Quakbot
dbbf53b95b91d68e321e5551c8a88ef3230ca525a4de1aa5e8219d4d71212f76
Quakbot
+ 150 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:tr campaign:1632730751 banker evasion stealer trojan
Link:
https://tria.ge/reports/210927-qext5shad8/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
95.77.223.148:443
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
109.12.111.14:443
105.198.236.99:443
73.77.87.137:443
41.248.239.221:995
182.176.112.182:443
96.37.113.36:993
75.66.88.33:443
162.244.227.34:443
24.229.150.54:995
216.201.162.158:443
92.59.35.196:2222
196.218.227.241:995
24.139.72.117:443
68.207.102.78:443
72.252.201.69:443
2.188.27.77:443
177.130.82.197:2222
68.204.7.158:443
189.210.115.207:443
181.163.96.53:443
24.55.112.61:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995
Unpacked files
SH256 hash:
fa730b725c72b03adcb0dc0a554d022d4b7c9e92b6b61379c71069cd97fd6a9c
MD5 hash:
536fcb86adb7b0ef7d550a876184128e
SHA1 hash:
2e2e2a74d41c3711e49cf5b6593fc82f6d667898
Link:
https://www.unpac.me/results/cdbf869a-a3bb-4d2b-bcc7-a26466d99c34/
SH256 hash:
328cf22049259d57ee9414f4e27dabf47e8020847e4966932eccf94d72fd90c8
MD5 hash:
576fdab0d7686f500b25cd2230bde4ab
SHA1 hash:
c3a00d51da5eb8272fe5aa9126b915007b8994bc
Link:
https://www.unpac.me/results/cdbf869a-a3bb-4d2b-bcc7-a26466d99c34/
SH256 hash:
336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da
MD5 hash:
97406f2cee93cdb660848c99e6d291e6
SHA1 hash:
17aa4ce85e931fdf383b864144a3c1b6e68f91e2
Link:
https://www.unpac.me/results/cdbf869a-a3bb-4d2b-bcc7-a26466d99c34/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

DLL dll 336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/192096/

Comments