MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 74ddf08baf8103c7c9101cb2a837c359e01b8c71b9afa92b26dd09851c4a358e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 10
| SHA256 hash: | 74ddf08baf8103c7c9101cb2a837c359e01b8c71b9afa92b26dd09851c4a358e |
|---|---|
| SHA3-384 hash: | 2ee76133854313526bfb8060ec238fc9ee51382e20846aba41da10f53da11f1eac3c7ff561ce38d733e72e48fa5790b4 |
| SHA1 hash: | a0b067356d45894d9d6a23f4c434b7232b3c7365 |
| MD5 hash: | 419fe68b6d0b6c33c8b7f3d1002b66ad |
| humanhash: | east-king-montana-nevada |
| File name: | 419fe68b6d0b6c33c8b7f3d1002b66ad |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 516'096 bytes |
| First seen: | 2021-11-19 19:08:10 UTC |
| Last seen: | 2021-11-19 20:54:55 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 800cd180252b50e4e4bde81ea61887f4 (2 x Quakbot) |
| ssdeep | 12288:KkOcqDoaYh0JYv+w27pFRm4xJv0Hz5bBD:KTcq+0J2+/pachI5 |
| Threatray | 376 similar samples on MalwareBazaar |
| TLSH | T12FB49F26F2D08437C27336B89C5B9764A836BE513D2D78C62BE51E4C4F397813B69293 |
| File icon (PE): |  |
| dhash icon | 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner) |
| Reporter |  malwarelabnet |
| Tags: | dll Qakbot Quakbot |
Intelligence
File Origin
# of uploads :
2
# of downloads :
256
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching a process
Modifying an executable file
Creating a process with a hidden window
DNS request
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
keylogger packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Verdict:
Malicious
Threat name:
Win32.Trojan.Injuke
Status:
Malicious
First seen:
2021-11-19 19:09:04 UTC
AV detection:
14 of 43 (32.56%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
qakbot
Similar samples:
+ 366 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:obama132 campaign:1637316939 banker evasion stealer trojan
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
176.45.246.154:995
177.76.159.233:995
136.143.11.232:443
39.49.71.230:995
140.82.49.12:443
136.232.34.70:443
218.101.110.3:995
186.64.67.17:443
45.9.20.200:2211
188.27.119.243:443
72.252.201.34:465
111.250.51.232:443
117.198.149.90:443
2.222.167.138:443
103.142.10.177:443
190.73.3.148:2222
89.137.52.44:443
123.252.190.14:443
197.87.144.239:443
89.101.97.139:443
209.210.95.228:443
194.36.28.26:443
117.248.109.38:21
182.176.180.73:443
24.152.219.253:995
207.246.112.221:443
207.246.112.221:995
216.238.71.31:443
220.255.25.187:2222
93.48.80.198:995
173.21.10.71:2222
71.74.12.34:443
75.188.35.168:995
73.151.236.31:443
96.37.113.36:993
189.135.61.226:443
75.169.58.229:32100
50.194.160.233:443
200.127.27.220:465
100.1.119.41:443
201.172.31.95:80
65.100.174.110:8443
72.252.201.34:995
103.116.178.85:61200
24.229.150.54:995
189.147.225.12:443
50.194.160.233:32100
105.198.236.99:995
73.171.4.177:443
86.8.177.143:443
24.55.112.61:443
93.48.58.123:2222
120.150.218.241:995
94.60.254.81:443
41.228.22.180:443
76.25.142.196:443
24.139.72.117:443
109.12.111.14:443
103.150.40.76:995
81.250.153.227:2222
5.193.134.177:995
68.204.7.158:443
217.165.237.204:443
78.191.34.234:995
86.97.160.193:443
27.223.92.142:995
45.46.53.140:2222
102.65.38.57:443
91.178.126.51:995
2.178.83.247:61202
101.50.103.248:995
80.6.192.58:443
27.5.5.31:2222
41.235.5.174:443
96.246.158.154:995
94.200.181.154:443
50.194.160.233:465
176.63.117.1:22
68.186.192.69:443
96.21.251.127:2222
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443
162.244.227.45:443
75.66.88.33:443
86.173.96.86:443
78.153.126.175:443
206.47.134.234:2222
93.147.212.206:443
71.13.93.154:2083
178.239.56.80:443
63.143.92.99:995
189.223.33.109:443
71.13.93.154:6881
81.174.162.180:995
103.143.8.71:995
73.140.38.124:443
79.160.207.214:443
83.223.164.163:443
71.13.93.154:2222
115.96.64.9:995
103.116.178.85:993
67.165.206.193:993
178.51.47.120:995
189.146.127.83:443
92.59.35.196:2222
177.76.159.233:995
136.143.11.232:443
39.49.71.230:995
140.82.49.12:443
136.232.34.70:443
218.101.110.3:995
186.64.67.17:443
45.9.20.200:2211
188.27.119.243:443
72.252.201.34:465
111.250.51.232:443
117.198.149.90:443
2.222.167.138:443
103.142.10.177:443
190.73.3.148:2222
89.137.52.44:443
123.252.190.14:443
197.87.144.239:443
89.101.97.139:443
209.210.95.228:443
194.36.28.26:443
117.248.109.38:21
182.176.180.73:443
24.152.219.253:995
207.246.112.221:443
207.246.112.221:995
216.238.71.31:443
220.255.25.187:2222
93.48.80.198:995
173.21.10.71:2222
71.74.12.34:443
75.188.35.168:995
73.151.236.31:443
96.37.113.36:993
189.135.61.226:443
75.169.58.229:32100
50.194.160.233:443
200.127.27.220:465
100.1.119.41:443
201.172.31.95:80
65.100.174.110:8443
72.252.201.34:995
103.116.178.85:61200
24.229.150.54:995
189.147.225.12:443
50.194.160.233:32100
105.198.236.99:995
73.171.4.177:443
86.8.177.143:443
24.55.112.61:443
93.48.58.123:2222
120.150.218.241:995
94.60.254.81:443
41.228.22.180:443
76.25.142.196:443
24.139.72.117:443
109.12.111.14:443
103.150.40.76:995
81.250.153.227:2222
5.193.134.177:995
68.204.7.158:443
217.165.237.204:443
78.191.34.234:995
86.97.160.193:443
27.223.92.142:995
45.46.53.140:2222
102.65.38.57:443
91.178.126.51:995
2.178.83.247:61202
101.50.103.248:995
80.6.192.58:443
27.5.5.31:2222
41.235.5.174:443
96.246.158.154:995
94.200.181.154:443
50.194.160.233:465
176.63.117.1:22
68.186.192.69:443
96.21.251.127:2222
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443
162.244.227.45:443
75.66.88.33:443
86.173.96.86:443
78.153.126.175:443
206.47.134.234:2222
93.147.212.206:443
71.13.93.154:2083
178.239.56.80:443
63.143.92.99:995
189.223.33.109:443
71.13.93.154:6881
81.174.162.180:995
103.143.8.71:995
73.140.38.124:443
79.160.207.214:443
83.223.164.163:443
71.13.93.154:2222
115.96.64.9:995
103.116.178.85:993
67.165.206.193:993
178.51.47.120:995
189.146.127.83:443
92.59.35.196:2222
Unpacked files
SH256 hash:
eabd14b6aad95af1293fb97efa6b61fdf60f813e7c3801aeaeeb229176ae9d74
MD5 hash:
73cc145585990db1760bc477f7713ede
SHA1 hash:
072bd7bc122359ec819601614e8dfa22416d9d6d
SH256 hash:
74ddf08baf8103c7c9101cb2a837c359e01b8c71b9afa92b26dd09851c4a358e
MD5 hash:
419fe68b6d0b6c33c8b7f3d1002b66ad
SHA1 hash:
a0b067356d45894d9d6a23f4c434b7232b3c7365
Malware family:
CryptOne
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | QakBot |
|---|---|
| Author: | kevoreilly |
| Description: | QakBot Payload |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.