MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 734f618a5d1cdf0cec77efe7aa492b49484a7e0853362c68577cea6d4e90fbbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 734f618a5d1cdf0cec77efe7aa492b49484a7e0853362c68577cea6d4e90fbbf
SHA3-384 hash: 84242cd7e317486c3a68e0b13af5183530d9ee95ed38c1edd41e0b8340df586bf6694a0978e94a34d84b42d70026fe30
SHA1 hash: 671f5fe47eabbf2d05cb7930b0a2d6c0c3c18a2d
MD5 hash: c46458d7d92acdf0e69bb7b907c3e9fe
humanhash: finch-batman-golf-early
File name:test.test
Download: download sample
Signature Quakbot
Create hunting rule
File size:850'464 bytes
First seen:2021-10-08 14:34:32 UTC
Last seen:2021-10-08 16:09:23 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 8c0d0671247235019d5724ca3b739bf7 (4 x Quakbot)
ssdeep 24576:Zz/lh7rH/i9rz+hwKzyUj/JGzwMgtx1EWsrbw4iaZ4gRrbY:Zz9h7e9rz+t/JGz5g3uWsrbw4iaqgRrM
Threatray 241 similar samples on MalwareBazaar
TLSH T167056B013A84D431E7EA55709E39C6E90A5C7D15DFB0A5CBBAD07F2F2AB94F39225302
Reporter ffforward
Tags:dll Qakbot qbot Quakbot test tr

Intelligence

File Origin
# of uploads :
2
# of downloads :
511
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/196190/
Detection(s):
SecuriteInfo.com.ArtemisC46458D7D92A.3742.17309.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-vm greyware overlay
Link:
https://www.filescan.io/uploads/6160571bb95458900cdf6189/reports/2ad8891b-ecd9-4649-a0be-a6d67599f8d7/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/734f618a5d1cdf0cec77efe7aa492b49484a7e0853362c68577cea6d4e90fbbf/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2021-10-08 14:35:12 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=onhwdcs5dtpqz3dx57t2usjljfeeu7qikm3cy2cxptvg2tuq7o7q._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
gozi
Create hunting rule
Similar samples:
05bd9cbf9725884979435d684a7268a75eb05d5916dc85325b0286e9ed71a038
Quakbot
0d1850712e82653dc7112d8bdae533b898a68f696c9b66dfe8f93120f73af191
Quakbot
12c388d2d4af3d8303e0fcf7136164317130cfb294c961f88f6cf4641c4f074a
Quakbot
2386996976337ff4bc0e5624822dcc7bd97d847b0e546f58068c35c1808276b0
Quakbot
241e148a3dbbe5e0032079887d3b714128736a3d5ba3f5fc253d7805d8349925
Quakbot
3889086935fd4818ec652f34cc8dfde7a071492fe5a50f5b523bdbe9acaa2861
Quakbot
3db836aa01204f3f894360b086384595b480b8c45472f97214d1676091851c9f
Quakbot
6f63742c25fd3a2dae5995f182254c253003066488ef86e754f661e8ba1d76fd
Quakbot
b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
Quakbot
f45a72880d244adbc4e7d41517e790b291ca235c7655f887d5eed31373516abb
Quakbot
+ 231 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:tr campaign:1633597626 banker evasion stealer trojan
Link:
https://tria.ge/reports/211008-rx1t7aefdk/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
120.150.218.241:995
185.250.148.74:443
89.137.52.44:443
66.103.170.104:2222
86.8.177.143:443
216.201.162.158:443
174.54.193.186:443
103.148.120.144:443
188.50.169.158:443
124.123.42.115:2222
140.82.49.12:443
199.27.127.129:443
81.241.252.59:2078
209.142.97.161:995
209.50.20.255:443
73.230.205.91:443
200.232.214.222:995
103.142.10.177:443
2.222.167.138:443
41.228.22.180:443
122.11.220.212:2222
78.191.58.219:995
47.22.148.6:443
74.72.237.54:443
217.17.56.163:465
96.57.188.174:2078
94.200.181.154:443
37.210.152.224:995
201.93.111.2:995
202.134.178.157:443
89.101.97.139:443
73.52.50.32:443
188.55.235.110:995
27.223.92.142:995
181.118.183.94:443
136.232.34.70:443
186.32.163.199:443
72.173.78.211:443
76.25.142.196:443
45.46.53.140:2222
98.157.235.126:443
173.21.10.71:2222
73.151.236.31:443
71.74.12.34:443
75.75.179.226:443
167.248.117.81:443
67.165.206.193:993
47.40.196.233:2222
72.252.201.69:443
181.4.53.6:465
109.12.111.14:443
24.171.50.5:443
24.139.72.117:443
24.55.112.61:443
24.229.150.54:995
77.57.204.78:443
81.250.153.227:2222
49.33.237.65:443
66.177.215.152:50010
177.170.201.134:995
75.188.35.168:443
120.151.47.189:443
173.25.162.221:443
201.6.246.227:995
66.177.215.152:443
217.17.56.163:2222
202.165.32.158:2222
39.52.229.8:995
42.60.70.14:443
73.140.38.124:443
167.248.100.227:443
63.70.164.200:443
69.30.186.190:443
189.131.221.201:443
68.204.7.158:443
181.84.114.46:443
167.248.99.149:443
177.94.21.110:995
50.54.32.149:443
189.224.181.39:443
24.119.214.7:443
63.70.164.200:995
177.94.125.59:995
82.18.173.253:2222
73.130.180.25:443
217.17.56.163:2078
162.244.227.34:443
75.66.88.33:443
206.47.134.234:2222
167.248.54.34:2222
73.77.87.137:443
181.4.53.6:443
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
68.186.192.69:443
162.210.220.137:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
105.198.236.99:443
103.157.122.198:995
4.34.193.180:995
159.2.51.200:2222
110.174.64.179:995
187.101.25.96:32100
76.84.230.103:443
174.59.35.191:443
173.63.245.129:443
68.117.229.117:443
75.163.81.130:995
76.84.32.159:443
147.92.51.49:443
76.84.226.17:443
68.13.157.69:443
167.248.126.223:443
72.196.22.184:443
98.22.92.139:995
97.98.130.50:443
196.117.224.53:995
191.191.38.8:443
188.210.210.122:443
96.46.103.109:2222
37.117.191.19:2222
197.90.137.161:61201
24.32.174.175:443
76.84.225.21:443
78.145.153.73:995
69.30.190.105:995
167.248.81.60:443
69.80.113.148:443
217.17.56.163:443
62.23.194.38:443
62.23.194.41:995
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
69.253.197.100:443
174.59.242.9:443
Unpacked files
SH256 hash:
50319ec10486c89da031c3d995bfc3948a6c2eb5ae673ade047d00c471e5371c
MD5 hash:
56900a09f2d873e34df3ca382ff73714
SHA1 hash:
a2c483e2e4b9786e1de3c41947bac844a60153f5
Link:
https://www.unpac.me/results/dda7a3ed-4158-4efd-8925-008ab3a74e2e/
SH256 hash:
69d0a21784bdb20ae3039c4ddfaa517504bae73a9321be6ac87343c0082f168d
MD5 hash:
8ebe84f27545bf37fc7e903cb7eba4f4
SHA1 hash:
6f0feec4d653a8c1e121cc16d74056eaca4cb626
Link:
https://www.unpac.me/results/dda7a3ed-4158-4efd-8925-008ab3a74e2e/
SH256 hash:
734f618a5d1cdf0cec77efe7aa492b49484a7e0853362c68577cea6d4e90fbbf
MD5 hash:
c46458d7d92acdf0e69bb7b907c3e9fe
SHA1 hash:
671f5fe47eabbf2d05cb7930b0a2d6c0c3c18a2d
Link:
https://www.unpac.me/results/dda7a3ed-4158-4efd-8925-008ab3a74e2e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/734f618a5d1cdf0cec77efe7aa492b49484a7e0853362c68577cea6d4e90fbbf

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

DLL dll 734f618a5d1cdf0cec77efe7aa492b49484a7e0853362c68577cea6d4e90fbbf

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/196190/

Comments