MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 3f7fa2310698749705e4b22ef4e17fcc1e2490b63e803bc9f25d47e0c932e4d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 10
| SHA256 hash: | 3f7fa2310698749705e4b22ef4e17fcc1e2490b63e803bc9f25d47e0c932e4d0 |
|---|---|
| SHA3-384 hash: | 423a0e80199d72e9c00a289f7defc9fc5832ab0ff9d8820682f35f2296c23fe9b468901ab1e85e8a17479b77ed3b9ea4 |
| SHA1 hash: | ceaf62b835fb6876738601409bd8ae63f8cfe8d8 |
| MD5 hash: | 8b978422d67d219cfe0106971462b3ec |
| humanhash: | pennsylvania-tennessee-friend-sink |
| File name: | 44522.7945435185.dat |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 577'024 bytes |
| First seen: | 2021-11-22 18:18:30 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 416415e911aa42153eb8380248997c88 (3 x Quakbot) |
| ssdeep | 12288:+us/hBtJdRXjuHAT2KKKKKbYKKjKXLtmhKAu0qfz673exX0KDOg:+r5/BXKFKKKKKbYKKjK7tmbu0qfe7uFS |
| Threatray | 380 similar samples on MalwareBazaar |
| TLSH | T1F7C49F22A2D08833D3632B3D9D5B926C9C19BE4D3B285D766FF81E4C9F357813526293 |
| File icon (PE): |  |
| dhash icon | 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner) |
| Reporter |  nokae8 |
| Tags: | dll obama133 Qakbot qbot Quakbot |
Intelligence
File Origin
# of uploads :
1
# of downloads :
337
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching a process
Modifying an executable file
Creating a process with a hidden window
DNS request
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
keylogger packed zusy
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Verdict:
Malicious
Threat name:
Win32.Trojan.PinkSbot
Status:
Malicious
First seen:
2021-11-22 18:19:12 UTC
File Type:
PE (Dll)
Extracted files:
38
AV detection:
31 of 45 (68.89%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
qakbot
Similar samples:
+ 370 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:obama133 campaign:1637586550 banker evasion stealer trojan
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
108.4.67.252:443
120.150.218.241:995
50.194.160.233:443
24.55.112.61:443
94.60.254.81:443
187.121.105.111:995
207.246.112.221:443
207.246.112.221:995
136.143.11.232:443
103.82.211.39:995
103.142.10.177:443
216.238.71.31:443
117.248.109.38:21
89.101.97.139:443
103.82.211.39:465
129.208.184.37:995
24.139.72.117:443
89.137.52.44:443
92.59.35.196:2222
194.36.28.26:443
81.250.153.227:2222
140.82.49.12:443
188.27.119.243:443
220.255.25.187:2222
93.48.80.198:995
111.250.0.147:443
117.198.148.180:443
136.232.34.70:443
68.186.192.69:443
103.116.178.85:993
218.101.110.3:995
5.31.156.18:995
2.222.167.138:443
86.97.160.193:443
182.176.180.73:443
76.25.142.196:443
173.21.10.71:2222
45.46.53.140:2222
73.151.236.31:443
71.74.12.34:443
189.135.61.226:443
86.8.177.143:443
67.165.206.193:993
109.12.111.14:443
75.188.35.168:995
86.173.96.86:443
217.165.237.42:443
93.147.212.206:443
105.198.236.99:995
75.169.58.229:32100
189.152.16.50:80
5.238.149.197:61202
39.49.45.75:995
72.252.201.34:995
100.1.119.41:443
24.152.219.253:995
189.147.225.12:443
96.37.113.36:993
24.229.150.54:995
200.127.27.220:465
186.64.67.17:443
45.9.20.200:2211
72.252.201.34:465
190.73.3.148:2222
209.210.95.228:443
103.150.40.76:995
68.204.7.158:443
123.252.190.14:443
197.89.108.131:443
80.6.192.58:443
65.100.174.110:8443
103.116.178.85:61200
50.194.160.233:32100
93.48.58.123:2222
41.228.22.180:443
78.191.52.30:995
27.223.92.142:995
102.65.38.57:443
91.178.126.51:995
101.53.254.9:995
27.5.4.111:2222
41.235.5.174:443
96.246.158.154:995
94.200.181.154:443
50.194.160.233:465
176.63.117.1:22
96.21.251.127:2222
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443
162.244.227.45:443
75.66.88.33:443
78.153.126.175:443
206.47.134.234:2222
71.13.93.154:2083
178.239.56.80:443
63.143.92.99:995
189.223.33.109:443
71.13.93.154:6881
81.174.162.180:995
103.143.8.71:995
73.140.38.124:443
79.160.207.214:443
83.223.164.163:443
71.13.93.154:2222
115.96.64.9:995
178.51.47.120:995
189.146.127.83:443
120.150.218.241:995
50.194.160.233:443
24.55.112.61:443
94.60.254.81:443
187.121.105.111:995
207.246.112.221:443
207.246.112.221:995
136.143.11.232:443
103.82.211.39:995
103.142.10.177:443
216.238.71.31:443
117.248.109.38:21
89.101.97.139:443
103.82.211.39:465
129.208.184.37:995
24.139.72.117:443
89.137.52.44:443
92.59.35.196:2222
194.36.28.26:443
81.250.153.227:2222
140.82.49.12:443
188.27.119.243:443
220.255.25.187:2222
93.48.80.198:995
111.250.0.147:443
117.198.148.180:443
136.232.34.70:443
68.186.192.69:443
103.116.178.85:993
218.101.110.3:995
5.31.156.18:995
2.222.167.138:443
86.97.160.193:443
182.176.180.73:443
76.25.142.196:443
173.21.10.71:2222
45.46.53.140:2222
73.151.236.31:443
71.74.12.34:443
189.135.61.226:443
86.8.177.143:443
67.165.206.193:993
109.12.111.14:443
75.188.35.168:995
86.173.96.86:443
217.165.237.42:443
93.147.212.206:443
105.198.236.99:995
75.169.58.229:32100
189.152.16.50:80
5.238.149.197:61202
39.49.45.75:995
72.252.201.34:995
100.1.119.41:443
24.152.219.253:995
189.147.225.12:443
96.37.113.36:993
24.229.150.54:995
200.127.27.220:465
186.64.67.17:443
45.9.20.200:2211
72.252.201.34:465
190.73.3.148:2222
209.210.95.228:443
103.150.40.76:995
68.204.7.158:443
123.252.190.14:443
197.89.108.131:443
80.6.192.58:443
65.100.174.110:8443
103.116.178.85:61200
50.194.160.233:32100
93.48.58.123:2222
41.228.22.180:443
78.191.52.30:995
27.223.92.142:995
102.65.38.57:443
91.178.126.51:995
101.53.254.9:995
27.5.4.111:2222
41.235.5.174:443
96.246.158.154:995
94.200.181.154:443
50.194.160.233:465
176.63.117.1:22
96.21.251.127:2222
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443
162.244.227.45:443
75.66.88.33:443
78.153.126.175:443
206.47.134.234:2222
71.13.93.154:2083
178.239.56.80:443
63.143.92.99:995
189.223.33.109:443
71.13.93.154:6881
81.174.162.180:995
103.143.8.71:995
73.140.38.124:443
79.160.207.214:443
83.223.164.163:443
71.13.93.154:2222
115.96.64.9:995
178.51.47.120:995
189.146.127.83:443
Unpacked files
SH256 hash:
9c841db3775c68106b353df39a1c4a5957769e83b7ccb366cfd06a68730aface
MD5 hash:
521d9bbfce0f89748755e88fe809cc8b
SHA1 hash:
8febe112ece1c92008a4cdd8063908f15b311a15
SH256 hash:
c55a411c79c4b92591556ba65da1c3b1914ba092df09eeef9bc57573a5b18fb5
MD5 hash:
ae07161a7eacfde76dc8ba525cbe6d5f
SHA1 hash:
7ab3579b8ad15ca2cbf6b4e938e112b89d113b4a
SH256 hash:
3f7fa2310698749705e4b22ef4e17fcc1e2490b63e803bc9f25d47e0c932e4d0
MD5 hash:
8b978422d67d219cfe0106971462b3ec
SHA1 hash:
ceaf62b835fb6876738601409bd8ae63f8cfe8d8
Malware family:
CryptOne
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | QakBot |
|---|---|
| Author: | kevoreilly |
| Description: | QakBot Payload |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Distributed via e-mail link
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.