MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ec6c63395dab6cb37cf16a6445f9ec3d31df0def1c47811563141653d0f3495. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	4ec6c63395dab6cb37cf16a6445f9ec3d31df0def1c47811563141653d0f3495
SHA3-384 hash:	5eacb28c984c7994a8c16d89ebc159c3b0321d5140b52269ccecd8098862391bac4a927ac46ad73ace6ff15d059693e5
SHA1 hash:	78622dc0fc5e204afa5df92ad898024b54f27520
MD5 hash:	6d2212c495657fb21e5ba55717f72de4
humanhash:	freddie-autumn-romeo-spaghetti
File name:	6d2212c495657fb21e5ba55717f72de4.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	387'072 bytes
First seen:	2021-09-27 17:42:47 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	ef258cd2a69e4871222e8a6651dd9af8 (8 x Quakbot)
ssdeep	3072:Do6vBnby4Yx0XjFFzPQ0MslzERfQB24hLxBVi/b/9+PdpiWC35ol/uwfTuT2b2MG:vs6Xpq0H3Jhds/9+qC/zfTPLs
Threatray	164 similar samples on MalwareBazaar
TLSH	T1BC846E27B7CEC812FB771FBFB2838A1455F2AD932123512E15E0B614F976A702992770
Reporter	abuse_ch
Tags:	1632729661 dll obama104 Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

284

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/192234/

Detection(s):

SecuriteInfo.com.BackDoor.Generic12.AOUE.3057.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Malware family:

Qakbot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/44f4a73e-cef7-4874-9266-0329b6810ce2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4ec6c63395dab6cb37cf16a6445f9ec3d31df0def1c47811563141653d0f3495/

Threat name:

Win32.Backdoor.Quakbot

Status:

Malicious

First seen:

2021-09-27 17:43:09 UTC

AV detection:

19 of 28 (67.86%)

Threat level:

5/5

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:obama104 campaign:1632729661 banker evasion stealer trojan

Link:

https://tria.ge/reports/210927-walh7shfbr/

Behaviour

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Qakbot/Qbot

Windows security bypass

Malware Config

C2 Extraction:

95.77.223.148:443
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
109.12.111.14:443
105.198.236.99:443
73.77.87.137:443
41.248.239.221:995
182.176.112.182:443
96.37.113.36:993
75.66.88.33:443
162.244.227.34:443
24.229.150.54:995
216.201.162.158:443
92.59.35.196:2222
196.218.227.241:995
24.139.72.117:443
68.207.102.78:443
72.252.201.69:443
2.188.27.77:443
177.130.82.197:2222
68.204.7.158:443
189.210.115.207:443
181.163.96.53:443
24.55.112.61:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995