MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 699414ec20038287dbec4aa01def60c5be9197a48bf32bc8c749ca6e82501e5c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 3
| SHA256 hash: | 699414ec20038287dbec4aa01def60c5be9197a48bf32bc8c749ca6e82501e5c |
|---|---|
| SHA3-384 hash: | d9e5f9251c05913b7f3f4211a69937b39a223f5417ac5c28946a492c2fa85102d6ec0e573342b2aae227345a3e84f906 |
| SHA1 hash: | 5346ecc437b23492d0506bd7d9b9c99b9a98121e |
| MD5 hash: | 09581f5365d86d57fc010da3f5a18e51 |
| humanhash: | cat-mike-may-robert |
| File name: | enjoying-G74-Dec23.zip |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 714'375 bytes |
| First seen: | 2022-12-23 15:14:02 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| Note: | This file is a password protected archive. The password is: U22 |
| ssdeep | 12288:mrzFhyKS3WWmV9jciUrBEtcXm8so86/SJ9So3rSuEsHBbLaUSwZ4lPaw:4JSGh9AzrB3m++jSKrScag25V |
| TLSH | T109E423DF8CACEEC2ECB138214D18F2B7707D6B0991CAB6A78565478D89477E84CD6390 |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  proxylife |
| Tags: | 1671781480 pw-U22 Qakbot Quakbot zip |
Intelligence
File Origin
# of uploads :
1
# of downloads :
150
Origin country :
IEFile Archive Information
This file is a password protected archive. The password is: U22
This file archive contains 5 file(s), sorted by their relevance:
| File name: | watchword.txt |
|---|---|
| File size: | 2'232'320 bytes |
| SHA256 hash: | 181a4948c8697e5bef1f9dbe896291c171700a5f8531c1a998b77ba1c64a9a8f |
| MD5 hash: | 3d74f4a94f70f72be294a6e2765eaa7a |
| MIME type: | text/plain |
| Signature | Quakbot |
| File name: | data.txt |
|---|---|
| File size: | 1'342 bytes |
| SHA256 hash: | 19c4f17b13c95a6d9c697ada1e4f4c06bae210aafe02800891d14c3d9a7828c0 |
| MD5 hash: | 31ae1fd3e6712f094e90dc3400fbd0b6 |
| MIME type: | text/plain |
| Signature | Quakbot |
| File name: | header |
|---|---|
| File size: | 104'857'600 bytes |
| SHA256 hash: | cd1f2a4b7893d1c70893ed2ba347e140d34bdcd2794097424083d9367fa5caa6 |
| MD5 hash: | 5937fb14ca678edd47fca8acbf0f12d0 |
| MIME type: | text/plain |
| Signature | Quakbot |
| File name: | guildsman.txt |
|---|---|
| File size: | 287'275 bytes |
| SHA256 hash: | 6f35470f6c80fb18e142aa704ad569583f772299b3c8c675df6230c91b049c69 |
| MD5 hash: | b4206f335c7ef048c4d34e2292fcb788 |
| MIME type: | text/plain |
| Signature | Quakbot |
| File name: | enjoying-G74.wsf |
|---|---|
| File size: | 484 bytes |
| SHA256 hash: | 405b8f2cb367e0fad300fcda2f7a93b17b2cf4e545a5ae0709a1a63d7fcf7cbe |
| MD5 hash: | 886626f72e3b4e7eaf76d806c853d3e6 |
| MIME type: | text/html |
| Signature | Quakbot |
Vendor Threat Intelligence
Gathering data
Result
Verdict:
UNKNOWN
Link:
Detection(s):
Suspicious file
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:bb11 campaign:1671792531 banker stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Loads dropped DLL
Qakbot/Qbot
Malware Config
C2 Extraction:
116.74.162.173:443
108.6.249.139:443
2.99.47.198:2222
89.79.229.50:443
89.152.120.181:443
152.170.17.136:443
197.0.175.244:443
83.248.199.56:443
84.113.121.103:443
175.139.207.179:2222
190.78.77.15:993
162.248.14.107:443
184.153.132.82:443
12.172.173.82:995
12.172.173.82:50001
37.15.128.31:2222
178.142.126.181:443
176.142.207.63:443
199.83.165.233:443
93.147.134.85:443
64.237.240.3:443
75.99.125.238:2222
184.68.116.146:3389
93.147.235.8:443
184.68.116.146:2222
66.191.69.18:995
27.0.62.241:995
92.189.214.236:2222
73.29.92.128:443
188.52.183.146:995
76.170.252.153:995
12.172.173.82:21
76.20.42.45:443
125.20.112.94:443
96.255.66.51:995
75.143.236.149:443
69.159.156.133:2222
84.35.26.14:995
89.129.109.27:2222
67.235.138.14:443
114.79.144.210:443
47.34.30.133:443
37.14.229.220:2222
183.87.163.165:443
103.141.50.151:995
76.80.180.154:995
181.118.183.50:443
72.80.7.6:995
184.68.116.146:2078
88.126.94.4:50000
70.77.116.233:443
50.68.204.71:443
190.199.157.49:2222
108.162.6.34:443
87.65.160.87:995
73.36.196.11:443
12.172.173.82:465
79.13.202.140:443
77.86.98.236:443
70.115.104.126:995
2.82.10.152:443
222.35.203.59:995
27.109.19.90:2078
80.103.77.44:2222
92.27.86.48:2222
181.4.227.82:443
84.219.213.130:2222
150.107.231.59:2222
181.118.206.65:995
103.42.86.42:995
87.220.205.65:2222
86.160.253.56:443
41.227.93.13:995
202.142.98.62:443
121.121.100.148:995
87.252.106.197:995
172.90.139.138:2222
172.248.42.122:443
76.100.159.250:443
24.142.218.202:443
92.8.187.85:2222
2.14.140.222:2222
69.133.162.35:443
83.114.60.6:2222
185.13.180.250:443
82.6.99.234:443
82.9.210.36:443
50.68.204.71:995
178.153.3.212:443
90.79.129.166:2222
46.24.136.17:2078
84.215.202.22:443
174.58.146.57:443
90.89.95.158:2222
51.211.219.211:443
24.228.132.224:2222
202.187.239.67:995
12.172.173.82:993
12.172.173.82:990
92.98.72.220:2222
86.96.75.237:2222
60.254.51.168:443
202.142.98.62:995
86.130.9.250:2222
46.10.198.106:443
78.101.91.215:2222
79.77.142.22:2222
12.172.173.82:22
12.172.173.82:32101
98.145.23.67:443
173.76.49.61:443
86.225.214.138:2222
173.18.126.3:443
75.98.154.19:443
103.212.19.254:995
74.92.243.113:50000
90.66.229.185:2222
74.66.134.24:443
108.6.249.139:443
2.99.47.198:2222
89.79.229.50:443
89.152.120.181:443
152.170.17.136:443
197.0.175.244:443
83.248.199.56:443
84.113.121.103:443
175.139.207.179:2222
190.78.77.15:993
162.248.14.107:443
184.153.132.82:443
12.172.173.82:995
12.172.173.82:50001
37.15.128.31:2222
178.142.126.181:443
176.142.207.63:443
199.83.165.233:443
93.147.134.85:443
64.237.240.3:443
75.99.125.238:2222
184.68.116.146:3389
93.147.235.8:443
184.68.116.146:2222
66.191.69.18:995
27.0.62.241:995
92.189.214.236:2222
73.29.92.128:443
188.52.183.146:995
76.170.252.153:995
12.172.173.82:21
76.20.42.45:443
125.20.112.94:443
96.255.66.51:995
75.143.236.149:443
69.159.156.133:2222
84.35.26.14:995
89.129.109.27:2222
67.235.138.14:443
114.79.144.210:443
47.34.30.133:443
37.14.229.220:2222
183.87.163.165:443
103.141.50.151:995
76.80.180.154:995
181.118.183.50:443
72.80.7.6:995
184.68.116.146:2078
88.126.94.4:50000
70.77.116.233:443
50.68.204.71:443
190.199.157.49:2222
108.162.6.34:443
87.65.160.87:995
73.36.196.11:443
12.172.173.82:465
79.13.202.140:443
77.86.98.236:443
70.115.104.126:995
2.82.10.152:443
222.35.203.59:995
27.109.19.90:2078
80.103.77.44:2222
92.27.86.48:2222
181.4.227.82:443
84.219.213.130:2222
150.107.231.59:2222
181.118.206.65:995
103.42.86.42:995
87.220.205.65:2222
86.160.253.56:443
41.227.93.13:995
202.142.98.62:443
121.121.100.148:995
87.252.106.197:995
172.90.139.138:2222
172.248.42.122:443
76.100.159.250:443
24.142.218.202:443
92.8.187.85:2222
2.14.140.222:2222
69.133.162.35:443
83.114.60.6:2222
185.13.180.250:443
82.6.99.234:443
82.9.210.36:443
50.68.204.71:995
178.153.3.212:443
90.79.129.166:2222
46.24.136.17:2078
84.215.202.22:443
174.58.146.57:443
90.89.95.158:2222
51.211.219.211:443
24.228.132.224:2222
202.187.239.67:995
12.172.173.82:993
12.172.173.82:990
92.98.72.220:2222
86.96.75.237:2222
60.254.51.168:443
202.142.98.62:995
86.130.9.250:2222
46.10.198.106:443
78.101.91.215:2222
79.77.142.22:2222
12.172.173.82:22
12.172.173.82:32101
98.145.23.67:443
173.76.49.61:443
86.225.214.138:2222
173.18.126.3:443
75.98.154.19:443
103.212.19.254:995
74.92.243.113:50000
90.66.229.185:2222
74.66.134.24:443
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | PassProtected_ZIP_ISO_file |
|---|---|
| Author: | _jc |
| Description: | Detects container formats commonly smuggled through password-protected zips |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Quakbot
zip 699414ec20038287dbec4aa01def60c5be9197a48bf32bc8c749ca6e82501e5c
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.