MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6b7ce26148fe55df48e887c1d18fa2c1bb12fa7d85d014dfaf4b801e345fd2cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 8
| SHA256 hash: | 6b7ce26148fe55df48e887c1d18fa2c1bb12fa7d85d014dfaf4b801e345fd2cc |
|---|---|
| SHA3-384 hash: | 964f2c252bb5dccdd7c699882ca62f3095e7427fda6fb7e06c8e331fdf3a2096a9eb3e8835b5a3a4c2575bb859824301 |
| SHA1 hash: | 093802dcb340c069532c443746c87423a24de619 |
| MD5 hash: | f1b1a33509a66493e33a3872126db517 |
| humanhash: | oscar-tennessee-pizza-avocado |
| File name: | file.dll |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 387'072 bytes |
| First seen: | 2021-09-27 15:14:28 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | ef258cd2a69e4871222e8a6651dd9af8 (8 x Quakbot) |
| ssdeep | 3072:Do6vBnby4Yx0XjFFzPQ0MslzERfQB24hLxBVi/b/9+PdpiWC35ol/uwfTuT2b2MA:vs6Xpq0H3Jhds/9+qC/zfTPL6 |
| Threatray | 161 similar samples on MalwareBazaar |
| TLSH | T1D2846E27B7CEC812FB771FBFB2838A1455F2AD932123512E15E0B614F976A702992770 |
| Reporter |  abuse_ch |
| Tags: | 1632729661 dll obama104 Qakbot qbot Quakbot |
abuse_ch
Quakbot payload URLs:http://185.250.148.213/44466.7053340278.dat
http://185.183.96.67/44466.7053340278.dat
http://190.14.37.178/44466.7053340278.dat
Quakbot C2s:
95.77.223.148:443
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
109.12.111.14:443
105.198.236.99:443
73.77.87.137:443
41.248.239.221:995
182.176.112.182:443
96.37.113.36:993
75.66.88.33:443
162.244.227.34:443
24.229.150.54:995
216.201.162.158:443
92.59.35.196:2222
196.218.227.241:995
24.139.72.117:443
68.207.102.78:443
72.252.201.69:443
2.188.27.77:443
177.130.82.197:2222
68.204.7.158:443
189.210.115.207:443
181.163.96.53:443
24.55.112.61:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995
Intelligence
File Origin
# of uploads :
1
# of downloads :
272
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Launching the default Windows debugger (dwwin.exe)
Malware family:
Qakbot
Verdict:
Malicious
Threat name:
Win32.Backdoor.Quakbot
Status:
Malicious
First seen:
2021-09-27 15:15:10 UTC
AV detection:
18 of 28 (64.29%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
qakbot
Similar samples:
+ 151 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:obama104 campaign:1632729661 banker evasion stealer trojan
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
95.77.223.148:443
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
109.12.111.14:443
105.198.236.99:443
73.77.87.137:443
41.248.239.221:995
182.176.112.182:443
96.37.113.36:993
75.66.88.33:443
162.244.227.34:443
24.229.150.54:995
216.201.162.158:443
92.59.35.196:2222
196.218.227.241:995
24.139.72.117:443
68.207.102.78:443
72.252.201.69:443
2.188.27.77:443
177.130.82.197:2222
68.204.7.158:443
189.210.115.207:443
181.163.96.53:443
24.55.112.61:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
109.12.111.14:443
105.198.236.99:443
73.77.87.137:443
41.248.239.221:995
182.176.112.182:443
96.37.113.36:993
75.66.88.33:443
162.244.227.34:443
24.229.150.54:995
216.201.162.158:443
92.59.35.196:2222
196.218.227.241:995
24.139.72.117:443
68.207.102.78:443
72.252.201.69:443
2.188.27.77:443
177.130.82.197:2222
68.204.7.158:443
189.210.115.207:443
181.163.96.53:443
24.55.112.61:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995
Unpacked files
SH256 hash:
805ff047d6310793ea09552ed31bbc0d58e0940122cbcb8925f311114e16c244
MD5 hash:
132232de2d82f95b73fcf22f8421e48c
SHA1 hash:
949b03c6635c641e55869cb752cbca9db6bc115c
SH256 hash:
6b7ce26148fe55df48e887c1d18fa2c1bb12fa7d85d014dfaf4b801e345fd2cc
MD5 hash:
f1b1a33509a66493e33a3872126db517
SHA1 hash:
093802dcb340c069532c443746c87423a24de619
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
xls Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.