MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3cde8a896848e9c28ccfcc2db7812602143de7be90aa44fcfe83c85ac7e53f9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 10
| SHA256 hash: | 3cde8a896848e9c28ccfcc2db7812602143de7be90aa44fcfe83c85ac7e53f9b |
|---|---|
| SHA3-384 hash: | e5915b7f3d334f95bdca81356e04d88b078c68b72af9c8d9b855eb9fb059845412f095e68a8b7a771e48285a41f30ba7 |
| SHA1 hash: | 5cd8cc40a71dc9a2b5ea8b023cb6f8bdb1c16748 |
| MD5 hash: | 13fc44f206bcd75d2880d39a22d777a3 |
| humanhash: | vegan-pizza-west-jersey |
| File name: | 2021-11-15-Qakbot-DLL-from-80.71.158.152.bin |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 565'248 bytes |
| First seen: | 2021-11-17 01:27:07 UTC |
| Last seen: | 2021-11-17 04:13:17 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 3c0eb09ac23fa3b588b375f2be1290b5 (1 x Quakbot) |
| ssdeep | 12288:GZWcHxLjZGL9ldTMMF8Mn261XfUZjsAzZat6mII:CZV0NHFdR817zZaT |
| Threatray | 372 similar samples on MalwareBazaar |
| TLSH | T1E4C4AE76F2C08833C533157C9D1BB39899397E412A2C9C4A7AE89C4C5E7B7C1B56D283 |
| File icon (PE): |  |
| dhash icon | 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner) |
| Reporter |  malware_traffic |
| Tags: | dll obama128b Qakbot qbot Quakbot |
Intelligence
File Origin
# of uploads :
3
# of downloads :
375
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching a process
Modifying an executable file
Creating a process with a hidden window
DNS request
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
keylogger packed qbot
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Verdict:
Malicious
Threat name:
Win32.Backdoor.Quakbot
Status:
Malicious
First seen:
2021-11-17 01:28:05 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
qakbot
Similar samples:
+ 362 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:obama128b campaign:1636996378 banker evasion stealer trojan
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
93.48.80.198:995
189.135.61.226:443
96.246.158.154:995
94.200.181.154:443
50.194.160.233:465
50.194.160.233:443
50.194.160.233:32100
24.229.150.54:995
140.82.49.12:443
108.4.67.252:443
136.143.11.232:443
109.177.77.68:995
181.118.183.27:443
24.55.112.61:443
109.12.111.14:443
216.238.71.31:443
190.229.18.108:465
188.50.23.59:995
120.150.218.241:995
89.101.97.139:443
45.9.20.200:2211
68.186.192.69:443
111.250.0.242:443
24.139.72.117:443
96.21.251.127:2222
102.65.38.57:443
86.98.3.14:443
91.178.126.51:995
41.228.22.180:443
100.1.119.41:443
81.250.153.227:2222
190.73.3.148:2222
68.204.7.158:443
72.252.201.34:995
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443
117.198.148.69:443
71.74.12.34:443
136.232.34.70:443
65.100.174.110:8443
96.37.113.36:993
197.89.109.187:443
94.60.254.81:443
103.142.10.177:443
39.49.46.75:995
117.248.109.38:21
103.116.178.85:61200
207.246.112.221:995
207.246.112.221:443
220.255.25.187:2222
86.8.177.143:443
89.137.52.44:443
105.198.236.99:995
188.27.119.243:443
173.21.10.71:2222
123.252.190.14:443
162.244.227.45:443
73.151.236.31:443
76.25.142.196:443
176.63.117.1:22
75.66.88.33:443
41.37.255.56:443
86.173.96.86:443
187.121.88.3:995
45.46.53.140:2222
75.169.58.229:32100
72.252.201.34:465
78.153.126.175:443
86.97.160.193:443
78.191.22.144:995
206.47.134.234:2222
189.152.18.180:80
93.147.212.206:443
71.13.93.154:2083
178.239.56.80:443
27.223.92.142:995
63.143.92.99:995
189.147.225.12:443
75.188.35.168:443
103.150.40.76:995
189.223.33.109:443
71.13.93.154:6881
2.222.167.138:443
182.176.180.73:443
94.196.209.83:995
103.143.8.71:995
115.186.190.72:995
73.140.38.124:443
79.160.207.214:443
83.223.164.163:443
71.13.93.154:2222
115.96.64.9:995
146.66.139.84:443
103.116.178.85:993
67.165.206.193:993
94.110.12.148:995
189.146.127.83:443
93.48.58.123:2222
92.59.35.196:2222
109.133.93.127:995
80.6.192.58:443
109.228.255.59:443
176.35.109.202:2222
72.27.126.188:995
103.143.8.71:443
185.53.147.51:443
216.201.162.158:443
39.52.224.170:995
189.135.61.226:443
96.246.158.154:995
94.200.181.154:443
50.194.160.233:465
50.194.160.233:443
50.194.160.233:32100
24.229.150.54:995
140.82.49.12:443
108.4.67.252:443
136.143.11.232:443
109.177.77.68:995
181.118.183.27:443
24.55.112.61:443
109.12.111.14:443
216.238.71.31:443
190.229.18.108:465
188.50.23.59:995
120.150.218.241:995
89.101.97.139:443
45.9.20.200:2211
68.186.192.69:443
111.250.0.242:443
24.139.72.117:443
96.21.251.127:2222
102.65.38.57:443
86.98.3.14:443
91.178.126.51:995
41.228.22.180:443
100.1.119.41:443
81.250.153.227:2222
190.73.3.148:2222
68.204.7.158:443
72.252.201.34:995
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443
117.198.148.69:443
71.74.12.34:443
136.232.34.70:443
65.100.174.110:8443
96.37.113.36:993
197.89.109.187:443
94.60.254.81:443
103.142.10.177:443
39.49.46.75:995
117.248.109.38:21
103.116.178.85:61200
207.246.112.221:995
207.246.112.221:443
220.255.25.187:2222
86.8.177.143:443
89.137.52.44:443
105.198.236.99:995
188.27.119.243:443
173.21.10.71:2222
123.252.190.14:443
162.244.227.45:443
73.151.236.31:443
76.25.142.196:443
176.63.117.1:22
75.66.88.33:443
41.37.255.56:443
86.173.96.86:443
187.121.88.3:995
45.46.53.140:2222
75.169.58.229:32100
72.252.201.34:465
78.153.126.175:443
86.97.160.193:443
78.191.22.144:995
206.47.134.234:2222
189.152.18.180:80
93.147.212.206:443
71.13.93.154:2083
178.239.56.80:443
27.223.92.142:995
63.143.92.99:995
189.147.225.12:443
75.188.35.168:443
103.150.40.76:995
189.223.33.109:443
71.13.93.154:6881
2.222.167.138:443
182.176.180.73:443
94.196.209.83:995
103.143.8.71:995
115.186.190.72:995
73.140.38.124:443
79.160.207.214:443
83.223.164.163:443
71.13.93.154:2222
115.96.64.9:995
146.66.139.84:443
103.116.178.85:993
67.165.206.193:993
94.110.12.148:995
189.146.127.83:443
93.48.58.123:2222
92.59.35.196:2222
109.133.93.127:995
80.6.192.58:443
109.228.255.59:443
176.35.109.202:2222
72.27.126.188:995
103.143.8.71:443
185.53.147.51:443
216.201.162.158:443
39.52.224.170:995
Unpacked files
SH256 hash:
29fab696f64f9f053bf55c035a130b7bf11269bec2900f8beaeaf221ee984e66
MD5 hash:
2b797f11bf793b6ecbd805a2a021822c
SHA1 hash:
dd9ee68471ac6be0d89d86bd183613575f16e774
SH256 hash:
c39dfd165660b81b5c857bd1c59a826899afb0301f21c4a528df6d433a5550bf
MD5 hash:
bd42fd7a4fe6dc94ff5750acd6bafbca
SHA1 hash:
54f45025eee5bd0009eb90392ce44237dc69e923
SH256 hash:
3cde8a896848e9c28ccfcc2db7812602143de7be90aa44fcfe83c85ac7e53f9b
MD5 hash:
13fc44f206bcd75d2880d39a22d777a3
SHA1 hash:
5cd8cc40a71dc9a2b5ea8b023cb6f8bdb1c16748
Malware family:
CryptOne
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | QakBot |
|---|---|
| Author: | kevoreilly |
| Description: | QakBot Payload |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.