MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056
SHA3-384 hash:	32d2f09d4ab64ff60e41db3e6071101515266a7b7ff1a98e604ef7b85c761306cd1dfafdf94e1ea7d4795a1a9d4d03d8
SHA1 hash:	9000b6d4a6bd850e25a0eaa61dd6d2915ff6eb0e
MD5 hash:	17e5d2175e0f253d23066ba788fbf636
humanhash:	nuts-golf-robin-carolina
File name:	17e5d2175e0f253d23066ba788fbf636.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	620'544 bytes
First seen:	2021-04-20 19:07:17 UTC
Last seen:	2021-04-20 19:59:03 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	94bf7abf28f2134634242522bc9b713f (3 x Quakbot)
ssdeep	12288:EGhxPFrs9lSJgFKPQvFjNXE5g5/S33SC7:jnBswuGQjSMM7
Threatray	111 similar samples on MalwareBazaar
TLSH	1BD46D62EA8084F7D2332A38BC3792E4582ABA403B265B5726D41F4BDF357C17F25257
Reporter	abuse_ch
Tags:	dll Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/140153/

Detection(s):

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Creating a process with a hidden window

Creating a window

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056/

Threat name:

Win32.Infostealer.QBot

Status:

Malicious

First seen:

2021-04-20 19:18:55 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=otyhqwja3h5anqm4ayzpnvjfhifwjcfdwfsods6tqpzj7o7rabla._file

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:clinton04 campaign:1618322109 banker stealer trojan

Link:

https://tria.ge/reports/210420-fysw9vm67a/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Qakbot/Qbot

Suspicious use of NtCreateProcessExOtherParentProcess

Malware Config

C2 Extraction:

75.137.47.174:443
140.82.49.12:443
151.205.102.42:443
24.226.156.153:443
24.43.22.221:993
216.201.162.158:443
76.25.142.196:443
149.28.99.97:995
149.28.101.90:2222
207.246.116.237:8443
149.28.99.97:443
45.63.107.192:2222
45.32.211.207:2222
149.28.101.90:443
45.77.117.108:995
207.246.77.75:443
207.246.77.75:8443
149.28.98.196:2222
45.32.211.207:995
45.32.211.207:443
45.32.211.207:8443
149.28.98.196:995
149.28.98.196:443
144.202.38.185:443
149.28.101.90:8443
207.246.77.75:995
207.246.77.75:2222
207.246.116.237:995
45.77.117.108:2222
144.202.38.185:2222
144.202.38.185:995
149.28.101.90:995
45.77.115.208:2222
207.246.116.237:443
45.77.117.108:443
45.63.107.192:443
45.77.115.208:443
45.77.115.208:995
45.77.115.208:8443
207.246.116.237:2222
45.77.117.108:8443
86.220.62.251:2222
71.163.222.243:443
24.55.112.61:443
67.8.103.21:443
190.85.91.154:443
97.69.160.4:2222
24.229.150.54:995
90.65.236.181:2222
72.240.200.181:2222
73.25.124.140:2222
24.152.219.253:995
47.196.192.184:443
193.248.221.184:2222
86.190.41.156:443
105.198.236.101:443
24.139.72.117:443
149.28.99.97:2222
45.63.107.192:995
78.63.226.32:443
24.117.107.120:443
136.232.34.70:443
81.97.154.100:443
71.187.170.235:443
47.22.148.6:443
75.67.192.125:443
188.26.91.212:443
71.74.12.34:443
71.41.184.10:3389
115.133.243.6:443
27.223.92.142:995
173.21.10.71:2222
73.151.236.31:443
75.118.1.141:443
108.14.4.202:443
98.252.118.134:443
186.31.46.121:443
67.165.206.193:993
109.12.111.14:443
98.192.185.86:443
105.198.236.99:443
197.45.110.165:995
50.244.112.106:443
72.252.201.69:443
96.61.23.88:995
45.46.53.140:2222
189.210.115.207:443
50.29.166.232:995
95.77.223.148:443
94.59.106.186:2078
83.110.109.164:2222
64.121.114.87:443
144.139.47.206:443
96.37.113.36:993
222.153.174.162:995
172.78.56.208:443
77.27.207.217:995
24.95.61.62:443
77.211.30.202:995
92.59.35.196:2222
106.51.52.111:995
184.189.122.72:443
195.12.154.8:443
68.186.192.69:443
75.136.40.155:443
71.117.132.169:443
96.21.251.127:2222
71.199.192.62:443
70.168.130.172:995
83.196.56.65:2222
81.214.126.173:2222
82.12.157.95:995
209.210.187.52:995
209.210.187.52:443
67.6.12.4:443
189.222.59.177:443
174.104.22.30:443
142.117.191.18:2222
189.146.183.105:443
213.60.147.140:443
196.221.207.137:995
108.46.145.30:443
187.250.238.164:995
2.7.116.188:2222
195.43.173.70:443
106.250.150.98:443
45.67.231.247:443
83.110.103.152:443
83.110.9.71:2222
78.97.207.104:443
59.90.246.200:443
80.227.5.69:443
125.63.101.62:443
86.236.77.68:2222
109.106.69.138:2222
84.72.35.226:443
217.133.54.140:32100
197.161.154.132:443
89.137.211.239:995
74.222.204.82:995
122.148.156.131:995
156.223.110.23:443
144.139.166.18:443
202.185.166.181:443
76.94.200.148:995
71.63.120.101:443
196.151.252.84:443
202.188.138.162:443
74.68.144.202:443
69.58.147.82:2078

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056