MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 421082e36a21c830cc0c12eb9dcbebaa13b5cc42008c1dc29c643d83df76ffb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 12
| SHA256 hash: | 421082e36a21c830cc0c12eb9dcbebaa13b5cc42008c1dc29c643d83df76ffb0 |
|---|---|
| SHA3-384 hash: | 0bd763178ff6a44060fd4cce90640ed6ec2b280ea1e3d0083683542598549f1b860ea2e7e01367833c2a7267d701bce8 |
| SHA1 hash: | 5fed4d956aba054029d80a9db9f2794de830566e |
| MD5 hash: | 8a54d9e56afcda7dc75fe59681ed78c9 |
| humanhash: | magnesium-cup-lithium-nuts |
| File name: | 44508.5578762731.dat.dll |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 1'123'840 bytes |
| First seen: | 2021-11-10 16:55:01 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | e0187cff4960b36cd54752cdc0601103 (1 x Quakbot) |
| ssdeep | 24576:RdQig2HGaAwaGhWZtJGKaI9PPFepfjcab3817zZan:Rd3hHRhR3i7A |
| Threatray | 360 similar samples on MalwareBazaar |
| TLSH | T1E4358E22B2D14437D1632A7D9C6BB358993A7F102E3C9C4A6BE51D4C4F3A6817D382E7 |
| File icon (PE): |  |
| dhash icon | 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner) |
| Reporter |  James_inthe_box |
| Tags: | dll Quakbot |
Intelligence
File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
keylogger packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
88 / 100
Signature
Allocates memory in foreign processes
Contains functionality to detect sleep reduction / modifications
Found detection on Joe Sandbox Cloud Basic with higher score
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Execute DLL with spoofed extension
Writes to foreign memory regions
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Injuke
Status:
Malicious
First seen:
2021-11-10 16:53:42 UTC
AV detection:
14 of 44 (31.82%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
qakbot
Similar samples:
+ 350 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:obama123 campaign:1636548103 banker evasion stealer trojan
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
39.49.72.230:995
72.252.147.208:465
45.9.20.200:2211
136.143.11.232:443
120.150.218.241:995
71.13.93.154:2222
24.139.72.117:443
71.13.93.154:6881
94.200.181.154:443
71.13.93.154:2083
123.252.190.14:443
86.98.1.197:443
96.21.251.127:2222
103.142.10.177:443
103.143.8.71:995
88.234.20.155:995
117.248.109.38:21
89.101.97.139:443
197.89.109.58:443
207.246.112.221:995
207.246.112.221:443
201.172.31.95:80
185.249.85.247:443
91.178.126.51:995
190.73.3.148:2222
81.250.153.227:2222
181.118.183.27:443
93.147.212.206:443
109.177.30.138:995
105.198.236.99:995
93.48.80.198:995
63.143.92.99:995
103.116.178.85:993
41.37.243.129:443
216.238.71.31:443
216.238.71.31:995
216.238.72.121:443
216.238.72.121:995
177.172.5.228:995
76.25.142.196:443
136.232.34.70:443
140.82.49.12:443
117.203.52.121:443
182.176.180.73:443
89.137.52.44:443
188.50.220.138:995
115.96.64.9:995
86.97.8.204:443
27.223.92.142:995
173.21.10.71:2222
71.74.12.34:443
67.165.206.193:993
73.151.236.31:443
189.135.98.193:443
75.66.88.33:443
94.110.12.148:995
50.194.160.233:443
83.223.164.163:443
100.1.119.41:443
65.100.174.110:8443
72.252.147.208:995
45.46.53.140:2222
189.147.225.12:443
50.194.160.233:32100
24.229.150.54:995
108.4.67.252:443
68.204.7.158:443
181.4.49.208:465
24.55.112.61:443
109.12.111.14:443
79.160.207.214:443
189.223.33.109:443
111.250.56.31:443
189.146.127.83:443
2.222.167.138:443
94.60.254.81:443
86.8.177.143:443
77.57.204.78:443
75.188.35.168:443
93.48.58.123:2222
41.228.22.180:443
96.37.113.36:993
68.186.192.69:443
92.59.35.196:2222
115.186.190.72:995
86.173.96.126:443
102.65.38.88:443
109.133.93.127:995
80.6.192.58:443
109.228.255.59:443
176.35.109.202:2222
72.27.126.188:995
61.247.182.5:995
103.143.8.71:443
185.53.147.51:443
75.169.58.229:32100
162.244.227.34:443
216.201.162.158:443
39.52.224.170:995
188.26.158.202:443
50.194.160.233:465
73.25.109.183:2222
47.72.219.120:995
196.207.140.40:995
115.96.188.188:995
96.246.158.154:995
70.93.80.154:443
88.253.105.24:443
27.5.5.31:2222
212.216.213.88:443
87.99.107.124:443
72.252.147.208:465
45.9.20.200:2211
136.143.11.232:443
120.150.218.241:995
71.13.93.154:2222
24.139.72.117:443
71.13.93.154:6881
94.200.181.154:443
71.13.93.154:2083
123.252.190.14:443
86.98.1.197:443
96.21.251.127:2222
103.142.10.177:443
103.143.8.71:995
88.234.20.155:995
117.248.109.38:21
89.101.97.139:443
197.89.109.58:443
207.246.112.221:995
207.246.112.221:443
201.172.31.95:80
185.249.85.247:443
91.178.126.51:995
190.73.3.148:2222
81.250.153.227:2222
181.118.183.27:443
93.147.212.206:443
109.177.30.138:995
105.198.236.99:995
93.48.80.198:995
63.143.92.99:995
103.116.178.85:993
41.37.243.129:443
216.238.71.31:443
216.238.71.31:995
216.238.72.121:443
216.238.72.121:995
177.172.5.228:995
76.25.142.196:443
136.232.34.70:443
140.82.49.12:443
117.203.52.121:443
182.176.180.73:443
89.137.52.44:443
188.50.220.138:995
115.96.64.9:995
86.97.8.204:443
27.223.92.142:995
173.21.10.71:2222
71.74.12.34:443
67.165.206.193:993
73.151.236.31:443
189.135.98.193:443
75.66.88.33:443
94.110.12.148:995
50.194.160.233:443
83.223.164.163:443
100.1.119.41:443
65.100.174.110:8443
72.252.147.208:995
45.46.53.140:2222
189.147.225.12:443
50.194.160.233:32100
24.229.150.54:995
108.4.67.252:443
68.204.7.158:443
181.4.49.208:465
24.55.112.61:443
109.12.111.14:443
79.160.207.214:443
189.223.33.109:443
111.250.56.31:443
189.146.127.83:443
2.222.167.138:443
94.60.254.81:443
86.8.177.143:443
77.57.204.78:443
75.188.35.168:443
93.48.58.123:2222
41.228.22.180:443
96.37.113.36:993
68.186.192.69:443
92.59.35.196:2222
115.186.190.72:995
86.173.96.126:443
102.65.38.88:443
109.133.93.127:995
80.6.192.58:443
109.228.255.59:443
176.35.109.202:2222
72.27.126.188:995
61.247.182.5:995
103.143.8.71:443
185.53.147.51:443
75.169.58.229:32100
162.244.227.34:443
216.201.162.158:443
39.52.224.170:995
188.26.158.202:443
50.194.160.233:465
73.25.109.183:2222
47.72.219.120:995
196.207.140.40:995
115.96.188.188:995
96.246.158.154:995
70.93.80.154:443
88.253.105.24:443
27.5.5.31:2222
212.216.213.88:443
87.99.107.124:443
Unpacked files
SH256 hash:
01d74c133eb271d62f0f28d3f1563103e485f663e3d88d0ee60af3e82f46cdb4
MD5 hash:
8bcaed585b2a43ccf7da44ecfc47a418
SHA1 hash:
f625bfd4689c3362d07fe89f9a375e45b1a1c43a
SH256 hash:
960c589adeacf5f510ea678d121109d551d990703d1301784870b4c6552e737f
MD5 hash:
041e091cdc90de7ee657e273bc379b73
SHA1 hash:
a6b42d4a883d07478d8fd7f5ccf60457fed24e0e
SH256 hash:
421082e36a21c830cc0c12eb9dcbebaa13b5cc42008c1dc29c643d83df76ffb0
MD5 hash:
8a54d9e56afcda7dc75fe59681ed78c9
SHA1 hash:
5fed4d956aba054029d80a9db9f2794de830566e
Malware family:
CryptOne
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | QakBot |
|---|---|
| Author: | kevoreilly |
| Description: | QakBot Payload |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.