MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 67486db1b558b02235a0a8edaa7183ab707c3c8d12ec87231cd12445856e2398. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 8
| SHA256 hash: | 67486db1b558b02235a0a8edaa7183ab707c3c8d12ec87231cd12445856e2398 |
|---|---|
| SHA3-384 hash: | 5c73590dc63138d26f5b7b2366f7045fbd47b4f531799fafd5865a13438e69ccafa6b5d29ee7b06bdf78fdcf7956e1ac |
| SHA1 hash: | 5ce7d68717141a0e3445ae12d60e7df390606caf |
| MD5 hash: | 3fe1ba2e012a387d454da8fd38b470ee |
| humanhash: | mirror-cat-uniform-yankee |
| File name: | el1.dll |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 724'968 bytes |
| First seen: | 2022-02-23 00:29:15 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | a2c4c1cc45cf157e67048505a3f85c3c (8 x Quakbot, 2 x Gozi) |
| ssdeep | 12288:SWV6nCx78UjtpeoRiYnMYbOZlfn40nBrttUzWHe42KfgT/2zIMg7+YAGnZUwQj:z6nCx78UZViDQOTfjnB5tUzmn2/bsMz0 |
| Threatray | 43 similar samples on MalwareBazaar |
| TLSH | T1BBF43BA28EA5780DEC75137857B392C4A50B9F732A35C1FF10C374968638314697FEAA |
| File icon (PE): |  |
| dhash icon | 6edbb12b17172b96 (10 x Quakbot, 9 x Heodo, 7 x BazaLoader) |
| Reporter |  Scoobs_McGee |
| Tags: | dll Qakbot Quakbot tr |
Intelligence
File Origin
# of uploads :
1
# of downloads :
174
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Searching for many windows
Сreating synchronization primitives
Launching a process
Modifying an executable file
Searching for synchronization primitives
Creating a process with a hidden window
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
overlay packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Verdict:
Malicious
Threat name:
Win32.Backdoor.Quakbot
Status:
Malicious
First seen:
2022-02-23 00:30:12 UTC
File Type:
PE (Dll)
Extracted files:
30
AV detection:
23 of 28 (82.14%)
Threat level:
5/5
Verdict:
malicious
Label(s):
qakbot
Similar samples:
+ 33 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:tr campaign:1645451777 banker evasion stealer trojan
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
31.35.28.29:443
105.186.167.230:995
72.252.201.34:990
40.134.247.125:995
186.64.87.194:443
2.50.41.69:61200
217.164.119.29:2222
161.142.53.137:443
74.15.2.252:2222
149.135.101.20:443
92.177.45.46:2078
190.73.3.148:2222
81.213.206.182:443
180.233.150.134:995
217.164.115.166:2222
144.202.2.175:443
105.184.116.32:995
47.180.172.159:50010
96.21.251.127:2222
140.82.49.12:443
176.67.56.94:443
66.230.104.103:443
206.217.0.154:995
47.180.172.159:443
75.99.168.194:443
24.178.196.158:2222
173.220.98.101:443
71.74.12.34:443
116.74.71.73:443
89.86.33.217:443
78.96.235.245:443
103.139.242.30:990
188.50.250.205:995
217.165.146.122:32101
173.174.216.62:443
78.101.202.183:6883
190.189.33.6:32101
47.23.89.60:993
70.45.27.254:443
102.65.38.67:443
89.101.97.139:443
69.14.172.24:443
136.143.11.232:443
103.142.10.177:443
38.70.253.226:2222
217.128.171.34:2222
197.165.161.159:995
82.152.39.39:443
111.125.245.116:995
130.164.206.70:443
39.44.136.96:995
144.202.2.175:995
75.99.168.194:61201
105.155.218.181:443
75.156.151.34:443
197.167.10.103:995
217.128.122.65:2222
102.47.31.216:995
124.41.193.166:443
67.209.195.198:443
32.221.231.1:443
182.191.92.203:995
78.101.82.120:2222
120.150.218.241:995
84.241.8.23:32103
103.87.95.131:2222
190.206.211.182:443
197.167.10.103:993
180.183.99.37:2222
39.52.203.68:995
190.189.33.6:443
39.52.121.208:995
41.36.82.58:3389
118.161.10.126:995
70.57.207.83:443
120.61.3.58:443
128.106.123.43:443
136.232.34.70:443
118.161.10.126:443
217.164.119.29:1194
89.137.52.44:443
175.137.153.178:443
208.107.221.224:443
86.98.150.158:995
39.41.254.161:995
76.25.142.196:443
45.46.53.140:2222
173.21.10.71:2222
47.23.89.60:995
73.151.236.31:443
189.146.51.56:443
67.165.206.193:993
109.12.111.14:443
75.188.35.168:443
86.198.170.170:2222
41.84.229.145:995
31.215.206.13:443
80.6.192.58:443
80.191.52.137:61202
103.230.180.119:443
197.92.132.79:443
86.98.55.231:995
5.237.251.118:995
41.230.62.211:993
5.89.175.136:443
86.98.11.110:443
84.241.8.23:2083
139.64.34.193:995
41.232.210.78:443
209.210.95.228:32100
70.51.137.204:2222
100.1.108.246:443
46.176.197.48:995
39.49.80.188:995
73.30.132.246:443
72.252.201.34:995
196.203.37.215:80
114.79.148.170:443
103.17.101.139:995
78.180.172.122:995
41.84.234.250:443
203.99.177.128:443
37.211.189.48:61202
108.4.67.252:443
201.40.225.216:443
200.104.16.99:993
181.98.246.214:443
217.165.109.191:993
197.89.21.163:443
188.210.148.245:443
185.113.58.135:443
39.53.116.250:995
39.52.21.207:993
72.66.116.235:995
184.149.30.83:2222
41.228.22.180:443
45.9.20.200:443
24.231.158.110:995
24.152.219.253:995
96.246.158.154:995
86.108.123.52:443
107.171.241.236:2222
5.48.205.15:443
103.116.178.85:443
182.176.180.73:443
102.132.145.147:443
47.180.172.159:993
177.205.182.145:443
24.53.49.240:443
105.186.167.230:995
72.252.201.34:990
40.134.247.125:995
186.64.87.194:443
2.50.41.69:61200
217.164.119.29:2222
161.142.53.137:443
74.15.2.252:2222
149.135.101.20:443
92.177.45.46:2078
190.73.3.148:2222
81.213.206.182:443
180.233.150.134:995
217.164.115.166:2222
144.202.2.175:443
105.184.116.32:995
47.180.172.159:50010
96.21.251.127:2222
140.82.49.12:443
176.67.56.94:443
66.230.104.103:443
206.217.0.154:995
47.180.172.159:443
75.99.168.194:443
24.178.196.158:2222
173.220.98.101:443
71.74.12.34:443
116.74.71.73:443
89.86.33.217:443
78.96.235.245:443
103.139.242.30:990
188.50.250.205:995
217.165.146.122:32101
173.174.216.62:443
78.101.202.183:6883
190.189.33.6:32101
47.23.89.60:993
70.45.27.254:443
102.65.38.67:443
89.101.97.139:443
69.14.172.24:443
136.143.11.232:443
103.142.10.177:443
38.70.253.226:2222
217.128.171.34:2222
197.165.161.159:995
82.152.39.39:443
111.125.245.116:995
130.164.206.70:443
39.44.136.96:995
144.202.2.175:995
75.99.168.194:61201
105.155.218.181:443
75.156.151.34:443
197.167.10.103:995
217.128.122.65:2222
102.47.31.216:995
124.41.193.166:443
67.209.195.198:443
32.221.231.1:443
182.191.92.203:995
78.101.82.120:2222
120.150.218.241:995
84.241.8.23:32103
103.87.95.131:2222
190.206.211.182:443
197.167.10.103:993
180.183.99.37:2222
39.52.203.68:995
190.189.33.6:443
39.52.121.208:995
41.36.82.58:3389
118.161.10.126:995
70.57.207.83:443
120.61.3.58:443
128.106.123.43:443
136.232.34.70:443
118.161.10.126:443
217.164.119.29:1194
89.137.52.44:443
175.137.153.178:443
208.107.221.224:443
86.98.150.158:995
39.41.254.161:995
76.25.142.196:443
45.46.53.140:2222
173.21.10.71:2222
47.23.89.60:995
73.151.236.31:443
189.146.51.56:443
67.165.206.193:993
109.12.111.14:443
75.188.35.168:443
86.198.170.170:2222
41.84.229.145:995
31.215.206.13:443
80.6.192.58:443
80.191.52.137:61202
103.230.180.119:443
197.92.132.79:443
86.98.55.231:995
5.237.251.118:995
41.230.62.211:993
5.89.175.136:443
86.98.11.110:443
84.241.8.23:2083
139.64.34.193:995
41.232.210.78:443
209.210.95.228:32100
70.51.137.204:2222
100.1.108.246:443
46.176.197.48:995
39.49.80.188:995
73.30.132.246:443
72.252.201.34:995
196.203.37.215:80
114.79.148.170:443
103.17.101.139:995
78.180.172.122:995
41.84.234.250:443
203.99.177.128:443
37.211.189.48:61202
108.4.67.252:443
201.40.225.216:443
200.104.16.99:993
181.98.246.214:443
217.165.109.191:993
197.89.21.163:443
188.210.148.245:443
185.113.58.135:443
39.53.116.250:995
39.52.21.207:993
72.66.116.235:995
184.149.30.83:2222
41.228.22.180:443
45.9.20.200:443
24.231.158.110:995
24.152.219.253:995
96.246.158.154:995
86.108.123.52:443
107.171.241.236:2222
5.48.205.15:443
103.116.178.85:443
182.176.180.73:443
102.132.145.147:443
47.180.172.159:993
177.205.182.145:443
24.53.49.240:443
Unpacked files
SH256 hash:
c8258dec0928c7ea9282d1adbc7f4f87b4c9cbb9e1cbc03e813374c4c26ba1c8
MD5 hash:
7acc3ea6ba912d23683201b395ab7843
SHA1 hash:
9deda15ec14e057ef42b2e6c895debb82bb17328
SH256 hash:
22ba2247f61ae701e65b08da9c09db9fab59202907d7b3565b31f5778e5bd6da
MD5 hash:
fcee4b28e625ca4c2a16107b555d5e1b
SHA1 hash:
616c2ac0f53e956a230b92dc7044be072d23f44b
SH256 hash:
67486db1b558b02235a0a8edaa7183ab707c3c8d12ec87231cd12445856e2398
MD5 hash:
3fe1ba2e012a387d454da8fd38b470ee
SHA1 hash:
5ce7d68717141a0e3445ae12d60e7df390606caf
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Malspam
Delivery method
Distributed via e-mail attachment
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.