MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6638ecb2ae947540a648ec9b2d7117907a117cf44ccc5849e3123bcbfdec6958. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	6638ecb2ae947540a648ec9b2d7117907a117cf44ccc5849e3123bcbfdec6958
SHA3-384 hash:	be2cd4cc548368aec55cfa135dfb4e998520862f08496eb1d566a8157fc9c49ae1d0a9f5f92c3613673ab1b80ed2fda6
SHA1 hash:	1e85dfd044a703a4d22f43843891633ace5af16e
MD5 hash:	2fd9d16b315b1a29f3e266999f00964d
humanhash:	avocado-fanta-king-carolina
File name:	2fd9d16b315b1a29f3e266999f00964d.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	725'504 bytes
First seen:	2021-10-07 08:59:52 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	3a9ce6dbfabfc6032e0cfde571419746 (4 x Quakbot)
ssdeep	12288:y+bAcis08s7gQFMWC24/MFS+AWmdXWJIjJ5F3+DpEFs3H6v/+hoTN:ysDis0dFA24/MFSptoJKnx+NE23a3+hS
Threatray	226 similar samples on MalwareBazaar
TLSH	T11CF46C403A55E521E6BD1A328F2AD5E807187D089FB5B4DF79E03F1F2AB98D3C621316
Reporter	abuse_ch
Tags:	dll Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

286

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/195729/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware

Link:

https://www.filescan.io/uploads/615eb71b98a6280f393384d3/reports/a8466d2d-f938-48d0-961b-91a8d5a02b8a/overview

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6638ecb2ae947540a648ec9b2d7117907a117cf44ccc5849e3123bcbfdec6958/

Threat name:

Win32.Infostealer.Dridex

Status:

Malicious

First seen:

2021-10-07 09:00:11 UTC

AV detection:

27 of 45 (60.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=my4ozmvosr2ubjsi5sns24ixsb5bc7hujtgfqspdci54x7pmnfma._file

Verdict:

malicious

Label(s):

qakbot

gozi

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:obama106 campaign:1632905607 banker evasion stealer trojan

Link:

https://tria.ge/reports/211007-kyc17acdbm/

Behaviour

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Qakbot/Qbot

Windows security bypass

Malware Config

C2 Extraction:

37.210.152.224:995
120.151.47.189:443
105.198.236.99:443
122.11.220.212:2222
199.27.127.129:443
41.251.41.14:995
216.201.162.158:443
124.123.42.115:2078
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
217.17.56.163:443
182.181.78.18:995
140.82.49.12:443
105.159.144.186:995
89.101.97.139:443
217.17.56.163:0
27.223.92.142:995
95.77.223.148:443
109.190.253.11:2222
81.250.153.227:2222
190.198.206.189:2222
81.241.252.59:2078
136.232.34.70:443
47.22.148.6:443
93.8.66.216:443
124.123.42.115:2222
217.17.56.163:2222
217.17.56.163:2078
217.17.56.163:465
41.228.22.180:443
76.25.142.196:443
71.74.12.34:443
71.80.168.245:443
75.188.35.168:443
173.21.10.71:2222
73.151.236.31:443
45.46.53.140:2222
67.165.206.193:993
38.10.201.211:443
72.252.201.69:443
71.60.246.5:443
92.148.59.207:2222
92.157.171.41:2222
24.139.72.117:443
186.18.205.199:995
24.229.150.54:995
47.40.196.233:2222
24.55.112.61:443
177.130.82.197:2222
109.12.111.14:443
68.204.7.158:443
186.87.135.68:995
80.6.192.58:443
103.148.120.144:443
75.66.88.33:443
173.25.166.81:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.108.147:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443