MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 45dfb37aa73869ed59120a0557c0ab25a9a3909915c578e502adf808910055d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 9
| SHA256 hash: | 45dfb37aa73869ed59120a0557c0ab25a9a3909915c578e502adf808910055d3 |
|---|---|
| SHA3-384 hash: | c32795945cd9c8b76c0dbc09496040ed69c15c6f0b2faaf45f9979e2ca215129487c7fde664eca288328844c797b6aaa |
| SHA1 hash: | 9bdc324d9524f89c698918b1fe8ae14ae70f817b |
| MD5 hash: | b62f59c059e74dd6f4876e98fb09da6c |
| humanhash: | fix-high-foxtrot-fix |
| File name: | 45dfb37aa73869ed59120a0557c0ab25a9a3909915c578e502adf808910055d3 |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 969'831 bytes |
| First seen: | 2022-03-11 12:53:02 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 4be20c1d0cff08001af7f6da02464dc6 (9 x Quakbot) |
| ssdeep | 24576:S9t3O1k4YwdH9CZ4nJ/TwiuPiwQU2SAHl4XoWSIgX4TH:S9n4RJlLYKKgX4T |
| Threatray | 172 similar samples on MalwareBazaar |
| TLSH | T1B9259D63E3D0487EC16A2B399D2B576898B96A113D24F4C63AE41C8C5F3764376273E3 |
| File icon (PE): |  |
| dhash icon | 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner) |
| Reporter |  malwarelabnet |
| Tags: | AA dll Qakbot Quakbot |
Intelligence
File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
DNS request
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
control.exe keylogger overlay packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Verdict:
Malicious
Threat name:
Win32.Trojan.BotX
Status:
Malicious
First seen:
2022-03-11 12:53:15 UTC
File Type:
PE (Dll)
Extracted files:
40
AV detection:
23 of 41 (56.10%)
Threat level:
5/5
Verdict:
malicious
Label(s):
qakbot
Similar samples:
+ 162 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:aa campaign:1646840852 banker stealer trojan
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Qakbot/Qbot
Malware Config
C2 Extraction:
82.152.39.39:443
91.177.173.10:995
140.82.49.12:443
176.67.56.94:443
47.180.172.159:443
75.99.168.194:443
140.82.63.183:443
140.82.63.183:995
181.118.183.94:443
2.50.27.78:443
41.230.62.211:993
24.43.99.75:443
217.165.79.31:443
24.178.196.158:2222
189.253.32.61:995
197.37.66.133:995
173.174.216.62:443
47.23.89.61:995
47.23.89.61:993
173.21.10.71:2222
191.112.19.94:443
196.203.37.215:80
69.159.200.138:2222
39.44.188.102:995
136.143.11.232:443
41.84.244.32:995
89.101.97.139:443
71.13.93.154:2222
176.57.126.138:443
75.99.168.194:61201
100.1.108.246:443
83.110.75.83:995
217.165.79.31:995
208.107.221.224:443
173.170.224.168:995
63.143.92.99:995
70.57.207.83:443
72.12.115.90:22
72.252.201.34:995
70.51.139.58:2222
114.79.148.170:443
103.139.242.30:990
80.11.74.81:2222
83.110.153.238:61200
139.64.13.51:995
70.46.220.114:443
72.252.201.34:990
144.202.2.175:995
190.189.33.6:32101
182.191.92.203:995
93.48.80.198:995
31.35.28.29:443
39.49.53.23:995
40.134.247.125:995
75.159.9.236:443
176.45.218.254:995
38.70.253.226:2222
92.99.229.158:2222
78.100.194.196:6883
96.246.158.154:995
89.211.187.132:2222
197.164.168.41:993
86.97.209.134:1194
76.70.9.169:2222
183.82.103.213:443
208.101.87.135:443
120.150.218.241:995
67.209.195.198:443
217.128.122.65:2222
197.237.74.185:995
79.167.199.210:995
45.9.20.200:443
96.21.251.127:2222
92.177.45.46:2078
206.217.0.154:995
186.10.247.110:443
172.114.160.81:995
209.210.95.228:32100
1.161.97.158:443
74.15.2.252:2222
78.169.100.120:443
105.186.100.243:995
41.228.22.180:443
63.153.150.20:443
70.163.1.219:443
86.195.158.178:2222
103.87.95.131:2222
72.76.94.99:443
190.73.3.148:2222
108.4.67.252:443
84.241.8.23:32103
24.55.67.176:443
80.14.188.219:2222
207.170.238.231:443
217.128.93.27:2222
149.28.238.199:443
45.63.1.12:995
144.202.3.39:995
144.202.3.39:443
45.76.167.26:995
45.63.1.12:443
45.76.167.26:443
144.202.2.175:443
149.28.238.199:995
117.248.109.38:21
197.89.21.109:443
89.86.33.217:443
120.61.3.163:443
86.98.11.110:443
217.165.85.106:993
5.95.58.211:2087
41.130.133.118:995
81.229.130.188:443
124.41.193.166:443
119.158.105.8:995
102.140.70.62:443
176.253.27.51:443
1.161.97.158:995
103.139.242.30:993
175.145.235.37:443
183.88.63.73:2222
128.106.122.181:443
39.52.62.239:995
76.25.142.196:443
32.221.225.247:443
121.74.187.191:995
86.98.48.115:995
71.74.12.34:443
189.146.51.56:443
191.99.191.28:443
73.151.236.31:443
216.10.217.114:443
76.169.147.192:32103
47.180.172.159:50010
187.170.7.81:443
47.156.191.217:443
201.170.181.247:443
5.32.41.45:443
172.114.160.81:443
68.204.7.158:443
105.187.31.228:995
187.59.18.65:443
31.215.70.101:443
109.12.111.14:443
41.84.246.125:443
83.110.218.135:32101
118.189.242.45:2083
39.52.217.44:995
89.137.52.44:443
217.164.120.130:2222
91.177.173.10:995
140.82.49.12:443
176.67.56.94:443
47.180.172.159:443
75.99.168.194:443
140.82.63.183:443
140.82.63.183:995
181.118.183.94:443
2.50.27.78:443
41.230.62.211:993
24.43.99.75:443
217.165.79.31:443
24.178.196.158:2222
189.253.32.61:995
197.37.66.133:995
173.174.216.62:443
47.23.89.61:995
47.23.89.61:993
173.21.10.71:2222
191.112.19.94:443
196.203.37.215:80
69.159.200.138:2222
39.44.188.102:995
136.143.11.232:443
41.84.244.32:995
89.101.97.139:443
71.13.93.154:2222
176.57.126.138:443
75.99.168.194:61201
100.1.108.246:443
83.110.75.83:995
217.165.79.31:995
208.107.221.224:443
173.170.224.168:995
63.143.92.99:995
70.57.207.83:443
72.12.115.90:22
72.252.201.34:995
70.51.139.58:2222
114.79.148.170:443
103.139.242.30:990
80.11.74.81:2222
83.110.153.238:61200
139.64.13.51:995
70.46.220.114:443
72.252.201.34:990
144.202.2.175:995
190.189.33.6:32101
182.191.92.203:995
93.48.80.198:995
31.35.28.29:443
39.49.53.23:995
40.134.247.125:995
75.159.9.236:443
176.45.218.254:995
38.70.253.226:2222
92.99.229.158:2222
78.100.194.196:6883
96.246.158.154:995
89.211.187.132:2222
197.164.168.41:993
86.97.209.134:1194
76.70.9.169:2222
183.82.103.213:443
208.101.87.135:443
120.150.218.241:995
67.209.195.198:443
217.128.122.65:2222
197.237.74.185:995
79.167.199.210:995
45.9.20.200:443
96.21.251.127:2222
92.177.45.46:2078
206.217.0.154:995
186.10.247.110:443
172.114.160.81:995
209.210.95.228:32100
1.161.97.158:443
74.15.2.252:2222
78.169.100.120:443
105.186.100.243:995
41.228.22.180:443
63.153.150.20:443
70.163.1.219:443
86.195.158.178:2222
103.87.95.131:2222
72.76.94.99:443
190.73.3.148:2222
108.4.67.252:443
84.241.8.23:32103
24.55.67.176:443
80.14.188.219:2222
207.170.238.231:443
217.128.93.27:2222
149.28.238.199:443
45.63.1.12:995
144.202.3.39:995
144.202.3.39:443
45.76.167.26:995
45.63.1.12:443
45.76.167.26:443
144.202.2.175:443
149.28.238.199:995
117.248.109.38:21
197.89.21.109:443
89.86.33.217:443
120.61.3.163:443
86.98.11.110:443
217.165.85.106:993
5.95.58.211:2087
41.130.133.118:995
81.229.130.188:443
124.41.193.166:443
119.158.105.8:995
102.140.70.62:443
176.253.27.51:443
1.161.97.158:995
103.139.242.30:993
175.145.235.37:443
183.88.63.73:2222
128.106.122.181:443
39.52.62.239:995
76.25.142.196:443
32.221.225.247:443
121.74.187.191:995
86.98.48.115:995
71.74.12.34:443
189.146.51.56:443
191.99.191.28:443
73.151.236.31:443
216.10.217.114:443
76.169.147.192:32103
47.180.172.159:50010
187.170.7.81:443
47.156.191.217:443
201.170.181.247:443
5.32.41.45:443
172.114.160.81:443
68.204.7.158:443
105.187.31.228:995
187.59.18.65:443
31.215.70.101:443
109.12.111.14:443
41.84.246.125:443
83.110.218.135:32101
118.189.242.45:2083
39.52.217.44:995
89.137.52.44:443
217.164.120.130:2222
Unpacked files
SH256 hash:
775d5100b3bb9b25e28fb528a01347ca76fb3eb3ab34a3d491573eed32980fa2
MD5 hash:
4c50bdfe0d26e0bb2f1e561cdcf19748
SHA1 hash:
a0bcf9c0f8941fe32ba7a98de46e702f03fd4c9b
SH256 hash:
5ba45432b9d6a4875c61ba9d44bde9bd10b974d5388bc0abe9ae9dfccfce7e56
MD5 hash:
98a0c7716dd4e393f3825761df54564b
SHA1 hash:
20a03b6c2b140151e04e2cdfce21bef04f228f75
SH256 hash:
45dfb37aa73869ed59120a0557c0ab25a9a3909915c578e502adf808910055d3
MD5 hash:
b62f59c059e74dd6f4876e98fb09da6c
SHA1 hash:
9bdc324d9524f89c698918b1fe8ae14ae70f817b
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.