MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 451e5353ca08889889954cf87c996299207f3e862fef83411e5ec34e0846ce71. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 3

Intelligence 3 IOCs YARA 7 File information Comments

SHA256 hash:	451e5353ca08889889954cf87c996299207f3e862fef83411e5ec34e0846ce71
SHA3-384 hash:	b9b1bacf6cb98bad1b5e4c7bc8a9f14827727970b9922c45ed0ac6a4df3c872e721dab6ffa4635fe613a46efc1b02eba
SHA1 hash:	d283ec0dd0b93c24b7fdc77e47f1ee8a1617e8c9
MD5 hash:	24ba387def3000f1b07b3cc3c90fdefb
humanhash:	michigan-queen-uncle-eighteen
File name:	UY76.zip
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	319'547 bytes
First seen:	2022-11-17 15:27:39 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
Note:	This file is a password protected archive. The password is: SK16
ssdeep	6144:2N+2e6ljb27F05CvUNc1QlisFHJ/NJyKWVXSDAOsKMvrgjC3VLWEl3c5cNn:ZP65yp05RAm9qSbsKy4UVLDceNn
TLSH	T1BE64238540CAD7A873561962303C6DD7778521FE27BC9639BE1D667A8A0024EDFC1F38
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	pr0xylife
Tags:	1668683197 BB06 pw-SK16 Qakbot Quakbot zip

Intelligence

File Origin

# of uploads :

# of downloads :

178

Origin country :

File Archive Information

This file is a password protected archive. The password is: SK16

This file archive contains 4 file(s), sorted by their relevance:

File name:	resemblance.tmp
File size:	707'584 bytes
SHA256 hash:	8ca16991684f7384c12b6622b8d1bcd23bc27f186f499c2059770ddd3031f274
MD5 hash:	0cffee80be59c6316a7132446b0da699
MIME type:	application/x-dosexec
Signature	Quakbot

File name:	data.txt
File size:	4 bytes
SHA256 hash:	d8fe2b17e090515cc50d18b20ccd07f427d793819f45c95b93301968895c59d6
MD5 hash:	d5aa073a3b23d7c09b6dd85845fe043c
MIME type:	text/plain
Signature	Quakbot

File name:	opinionate.txt
File size:	87'900 bytes
SHA256 hash:	3f13d66ea43ead0a8f0c5233806605abf1d6a37aa27ba8b61d4a3ca9f499911d
MD5 hash:	fe66eb2c982ac8755c31017f2b63ce0d
MIME type:	text/plain
Signature	Quakbot

File name:	WW.js
File size:	9'767 bytes
SHA256 hash:	c5df8f8328103380943d8ead5345ca9fe8a9d495634db53cf9ea3266e353a3b1
MD5 hash:	7805b0885e64e4ab56bbee1e7a42db0b
MIME type:	text/plain
Signature	Quakbot

Vendor Threat Intelligence

Gathering data

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/451e5353ca08889889954cf87c996299207f3e862fef83411e5ec34e0846ce71

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/451e5353ca08889889954cf87c996299207f3e862fef83411e5ec34e0846ce71/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iupfgu6kbcejrcmvjt4hzglcteqh6pugf7xygqi6l3bu4ccgzzyq._file

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:bb06 campaign:1668683197 banker stealer trojan

Link:

https://tria.ge/reports/221117-tmxqwsah4y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Qakbot/Qbot

Malware Config

C2 Extraction:

23.240.47.58:995
12.172.173.82:465
91.169.12.198:32100
94.63.65.146:443
80.13.179.151:2222
64.207.237.118:443
24.206.27.39:443
83.114.60.6:2222
86.171.75.63:443
86.195.32.149:2222
170.253.25.35:443
92.185.204.18:2078
157.231.42.190:995
170.249.59.153:443
174.101.111.4:443
116.74.163.152:443
76.80.180.154:995
180.151.104.143:443
86.130.9.167:2222
86.99.15.243:2222
90.104.22.28:2222
172.117.139.142:995
103.141.50.117:995
176.142.207.63:443
71.183.236.133:443
131.106.168.223:443
190.75.110.239:443
70.66.199.12:443
183.87.31.34:443
83.110.223.247:443
47.34.30.133:443
71.247.10.63:995
92.207.132.174:2222
89.129.109.27:2222
12.172.173.82:21
87.202.101.164:50000
2.99.47.198:2222
154.247.95.119:2078
197.148.17.17:2078
37.14.229.220:2222
78.247.21.20:443
112.141.184.246:995
142.161.27.232:2222
71.247.10.63:50003
108.6.249.139:443
92.239.81.124:443
184.176.154.83:995
184.153.132.82:443
74.66.134.24:443
24.64.114.59:3389
105.184.161.242:443
73.36.196.11:443
82.31.37.241:443
24.116.45.121:443
213.67.255.57:2222
200.93.14.206:2222
91.254.215.167:443
87.220.205.14:2222
92.27.86.48:2222
73.230.28.7:443
176.151.15.101:443
24.64.114.59:2222
86.165.15.180:2222
66.191.69.18:995
175.205.2.54:443
64.121.161.102:443
87.99.116.47:443
180.156.240.239:995
12.172.173.82:22
50.68.204.71:995
213.91.235.146:443
174.77.209.5:443
76.127.192.23:443
50.68.204.71:443
109.11.175.42:2222
199.83.165.233:443
91.68.227.219:443
45.248.169.101:443
85.59.61.52:2222
85.139.176.42:2222
82.34.170.37:443
157.231.42.190:443
76.20.42.45:443
27.110.134.202:995
89.115.196.99:443
83.11.84.105:2222
12.172.173.82:2087
12.172.173.82:443
181.118.183.116:443
174.45.15.123:443
77.126.81.208:443
92.106.70.62:2222
82.121.73.56:2222
173.239.94.212:443
187.199.224.16:32103
183.82.100.110:2222
186.188.2.193:443
41.62.227.225:443
75.99.125.238:2222
2.84.98.228:2222
82.121.237.106:2222
100.6.8.7:443
85.241.180.94:443
79.37.204.67:443
217.128.91.196:2222
58.247.115.126:995
12.172.173.82:993
98.147.155.235:443
102.157.69.217:995
212.251.122.147:995
92.137.74.174:2222
24.228.132.224:2222
69.119.123.159:2222
89.79.229.50:443
47.176.30.75:443
174.104.184.149:443
173.32.181.236:443
74.92.243.113:50000
12.172.173.82:995
58.186.75.42:443

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BitcoinAddress Create hunting rule
Author:	Didier Stevens (@DidierStevens)
Description:	Contains a valid Bitcoin address

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	PassProtected_ZIP_ISO_file Create hunting rule
Author:	_jc
Description:	Detects container formats commonly smuggled through password-protected zips

Rule name:	QakBot Create hunting rule
Author:	kevoreilly
Description:	QakBot Payload

Rule name:	unpacked_qbot Create hunting rule
Description:	Detects unpacked or memory-dumped QBot samples

Rule name:	win_qakbot_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.qakbot.

Rule name:	win_qakbot_malped Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample