MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 9
| SHA256 hash: | 644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e |
|---|---|
| SHA3-384 hash: | 4dc5bf95d6e573f2a792e8658e2ea5290f9805daf6428b29b6926c5a89ed0fc601994c8460687d052bd5d9c42db95bfa |
| SHA1 hash: | 957b8cd7babadf9d5104fb11e7508def071e08a9 |
| MD5 hash: | 7531aa8c3508046d1f17de8087915332 |
| humanhash: | nitrogen-friend-california-diet |
| File name: | 644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 523'264 bytes |
| First seen: | 2022-03-22 12:49:15 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 9e45408bef939ba7b084556548e54b63 (2 x Quakbot) |
| ssdeep | 12288:l7kLQI89Rji0iEm2aY6XXQtVOlrFaMUm3HNNkpIdYKi:l7QxkjFOXKO5FaMzHNSpIC |
| Threatray | 330 similar samples on MalwareBazaar |
| TLSH | T19AB4C0B53604BDE6E57F463BD9A59CDD137626228AC7D8CD90A077C30A733A1EE12C06 |
| Reporter |  malwarelabnet |
| Tags: | dll obama168 Qakbot Quakbot |
Intelligence
File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Creating a window
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Verdict:
Malicious
Threat name:
Win32.Backdoor.Quakbot
Status:
Malicious
First seen:
2022-03-22 12:50:13 UTC
File Type:
PE (Dll)
AV detection:
20 of 26 (76.92%)
Threat level:
5/5
Verdict:
malicious
Label(s):
qakbot
Similar samples:
+ 320 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:obama168 campaign:1647853291 banker stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
103.87.95.131:2222
195.32.57.18:80
92.99.229.158:2222
40.134.246.185:995
31.215.118.154:1194
41.228.22.180:443
39.49.39.239:995
217.128.122.65:2222
86.98.27.253:443
82.152.39.39:443
197.0.103.214:443
76.169.147.192:32103
24.152.219.253:995
37.186.54.166:995
202.134.152.2:2222
177.134.208.155:993
45.239.129.13:443
1.161.76.70:995
120.150.218.241:995
79.52.204.9:50001
74.15.2.252:2222
206.217.0.154:995
209.180.70.25:443
2.34.12.8:443
175.145.235.37:443
39.44.151.33:995
120.61.0.6:443
190.73.3.148:2222
76.70.9.169:2222
76.69.155.202:2222
217.165.109.52:993
161.142.56.8:443
31.215.69.127:443
5.95.58.211:2087
130.164.149.84:443
75.99.168.194:443
96.21.251.127:2222
140.82.49.12:443
124.41.193.166:443
80.11.74.81:2222
108.60.213.141:443
176.67.56.94:443
37.152.80.105:443
196.203.37.215:80
148.64.96.100:443
197.162.109.164:995
102.140.71.40:443
47.180.172.159:443
91.177.173.10:995
217.165.79.31:443
182.191.92.203:995
31.35.28.29:443
24.43.99.75:443
5.32.41.45:443
103.88.226.82:443
86.195.158.178:2222
93.48.80.198:995
47.180.172.159:50010
75.99.168.194:61201
45.9.20.200:443
173.174.216.62:443
47.23.89.62:993
197.167.5.180:993
144.202.2.175:995
140.82.63.183:995
144.202.3.39:443
149.28.238.199:443
45.76.167.26:443
140.82.63.183:443
45.76.167.26:995
45.63.1.12:995
149.28.238.199:995
144.202.2.175:443
144.202.3.39:995
45.63.1.12:443
207.170.238.231:443
197.92.138.54:443
71.13.93.154:2222
32.221.225.247:995
69.159.200.138:2222
37.210.149.61:2222
180.233.150.134:995
186.10.247.110:443
113.11.89.170:995
188.50.49.149:995
141.237.95.186:995
217.165.79.31:995
92.177.45.46:2078
106.51.48.170:50001
47.23.89.62:995
70.57.207.83:443
31.215.118.154:2222
172.115.177.204:2222
110.143.139.163:443
72.76.94.99:443
70.46.220.114:443
24.178.196.158:2222
67.209.195.198:443
121.74.182.236:995
75.159.9.236:443
172.114.160.81:995
78.188.76.167:443
1.161.76.70:443
2.42.176.91:443
76.23.237.163:995
128.106.123.187:443
103.157.122.130:21
67.165.206.193:993
39.52.66.201:995
191.99.191.28:443
174.69.215.101:443
76.25.142.196:443
173.21.10.71:2222
71.74.12.34:443
189.146.51.56:443
208.107.221.224:443
143.0.34.185:443
73.151.236.31:443
82.41.63.217:443
73.59.201.174:443
109.12.111.14:443
45.46.53.140:2222
89.101.97.139:443
86.198.170.170:2222
38.70.253.226:2222
41.84.240.210:995
86.98.150.187:995
86.180.31.38:443
103.230.180.119:443
89.137.52.44:443
197.37.7.47:995
75.188.35.168:443
187.199.203.159:443
72.12.115.90:22
189.237.6.251:443
201.172.31.135:2222
201.170.181.247:443
105.184.195.104:995
177.134.208.155:995
125.25.133.221:443
114.79.148.170:443
180.129.97.57:995
58.105.167.35:50000
201.145.160.158:443
201.103.6.221:443
47.156.191.217:443
70.51.135.39:2222
63.143.92.99:995
86.105.44.249:61202
100.1.108.246:443
195.32.57.18:80
92.99.229.158:2222
40.134.246.185:995
31.215.118.154:1194
41.228.22.180:443
39.49.39.239:995
217.128.122.65:2222
86.98.27.253:443
82.152.39.39:443
197.0.103.214:443
76.169.147.192:32103
24.152.219.253:995
37.186.54.166:995
202.134.152.2:2222
177.134.208.155:993
45.239.129.13:443
1.161.76.70:995
120.150.218.241:995
79.52.204.9:50001
74.15.2.252:2222
206.217.0.154:995
209.180.70.25:443
2.34.12.8:443
175.145.235.37:443
39.44.151.33:995
120.61.0.6:443
190.73.3.148:2222
76.70.9.169:2222
76.69.155.202:2222
217.165.109.52:993
161.142.56.8:443
31.215.69.127:443
5.95.58.211:2087
130.164.149.84:443
75.99.168.194:443
96.21.251.127:2222
140.82.49.12:443
124.41.193.166:443
80.11.74.81:2222
108.60.213.141:443
176.67.56.94:443
37.152.80.105:443
196.203.37.215:80
148.64.96.100:443
197.162.109.164:995
102.140.71.40:443
47.180.172.159:443
91.177.173.10:995
217.165.79.31:443
182.191.92.203:995
31.35.28.29:443
24.43.99.75:443
5.32.41.45:443
103.88.226.82:443
86.195.158.178:2222
93.48.80.198:995
47.180.172.159:50010
75.99.168.194:61201
45.9.20.200:443
173.174.216.62:443
47.23.89.62:993
197.167.5.180:993
144.202.2.175:995
140.82.63.183:995
144.202.3.39:443
149.28.238.199:443
45.76.167.26:443
140.82.63.183:443
45.76.167.26:995
45.63.1.12:995
149.28.238.199:995
144.202.2.175:443
144.202.3.39:995
45.63.1.12:443
207.170.238.231:443
197.92.138.54:443
71.13.93.154:2222
32.221.225.247:995
69.159.200.138:2222
37.210.149.61:2222
180.233.150.134:995
186.10.247.110:443
113.11.89.170:995
188.50.49.149:995
141.237.95.186:995
217.165.79.31:995
92.177.45.46:2078
106.51.48.170:50001
47.23.89.62:995
70.57.207.83:443
31.215.118.154:2222
172.115.177.204:2222
110.143.139.163:443
72.76.94.99:443
70.46.220.114:443
24.178.196.158:2222
67.209.195.198:443
121.74.182.236:995
75.159.9.236:443
172.114.160.81:995
78.188.76.167:443
1.161.76.70:443
2.42.176.91:443
76.23.237.163:995
128.106.123.187:443
103.157.122.130:21
67.165.206.193:993
39.52.66.201:995
191.99.191.28:443
174.69.215.101:443
76.25.142.196:443
173.21.10.71:2222
71.74.12.34:443
189.146.51.56:443
208.107.221.224:443
143.0.34.185:443
73.151.236.31:443
82.41.63.217:443
73.59.201.174:443
109.12.111.14:443
45.46.53.140:2222
89.101.97.139:443
86.198.170.170:2222
38.70.253.226:2222
41.84.240.210:995
86.98.150.187:995
86.180.31.38:443
103.230.180.119:443
89.137.52.44:443
197.37.7.47:995
75.188.35.168:443
187.199.203.159:443
72.12.115.90:22
189.237.6.251:443
201.172.31.135:2222
201.170.181.247:443
105.184.195.104:995
177.134.208.155:995
125.25.133.221:443
114.79.148.170:443
180.129.97.57:995
58.105.167.35:50000
201.145.160.158:443
201.103.6.221:443
47.156.191.217:443
70.51.135.39:2222
63.143.92.99:995
86.105.44.249:61202
100.1.108.246:443
Unpacked files
SH256 hash:
b9db59bce5b55ead7e9aa151251b298d607ff2e4b03fc418bb6e01d47bd1cb8a
MD5 hash:
8e745160200ff682e080a17be4bd86ff
SHA1 hash:
f40ebd2f7b8953bfd9e6a9f91bbeaf9e69fb593f
SH256 hash:
644f00812319bdb00411294b2ddb4e9f86bf0797f825543ea0fe16db1e1aea4e
MD5 hash:
7531aa8c3508046d1f17de8087915332
SHA1 hash:
957b8cd7babadf9d5104fb11e7508def071e08a9
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.