MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c6a9dc5626bd62584851b56ce9e386cf5a494e6c5c2d1e36032798edb9405b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	7c6a9dc5626bd62584851b56ce9e386cf5a494e6c5c2d1e36032798edb9405b0
SHA3-384 hash:	6189c8d0ad7a0718e19883d1e627bb10f52e3f7d777e2a076d2ef57ae1a716f9c39224d8c34d939dd94bb3e988c895ed
SHA1 hash:	5b2cfc4f23aa8e4679d4434c73979c51f26c5486
MD5 hash:	5c4c1023d8ed47504cc64deaef91e40e
humanhash:	purple-fix-black-hotel
File name:	5c4c1023d8ed47504cc64deaef91e40e.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	551'936 bytes
First seen:	2021-09-22 18:13:33 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	c900f0b45b7574481cc6a21428393566 (11 x Quakbot)
ssdeep	12288:t1ghp5DubQ0ErdxA+zM5miTrqZj1kENwNmhxOsNU:avrv05T+ZjHNwKOs
Threatray	122 similar samples on MalwareBazaar
TLSH	T140C4AE19BEC3D1A1C83C197488A1C8F27638B865AD54D6473AE93F3F5EB31C25C560AE
Reporter	abuse_ch
Tags:	1632302707 dll obama102 Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

347

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/190391/

Detection(s):

SecuriteInfo.com.Artemis5C4C1023D8ED.28072.18896.UNOFFICIAL

Malware family:

Qakbot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/232eb227-01e4-47a3-8837-d574e46d9b05

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7c6a9dc5626bd62584851b56ce9e386cf5a494e6c5c2d1e36032798edb9405b0/

Threat name:

Win32.Worm.Cridex

Status:

Malicious

First seen:

2021-09-22 18:14:20 UTC

AV detection:

5 of 28 (17.86%)

Threat level:

5/5

Verdict:

malicious

Label(s):

qakbot

gozi

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:obama102 campaign:1632302707 banker stealer trojan

Link:

https://tria.ge/reports/210922-wvdn4agacm/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Loads dropped DLL

Qakbot/Qbot

Malware Config

C2 Extraction:

120.150.218.241:995
47.22.148.6:443
105.198.236.99:443
95.77.223.148:443
140.82.49.12:443
27.223.92.142:995
73.151.236.31:443
136.232.34.70:443
144.139.47.206:443
45.46.53.140:2222
76.25.142.196:443
173.21.10.71:2222
75.188.35.168:443
71.74.12.34:443
96.37.113.36:993
67.165.206.193:993
189.210.115.207:443
72.252.201.69:443
24.139.72.117:443
24.229.150.54:995
68.204.7.158:443
109.12.111.14:443
24.55.112.61:443
216.201.162.158:443
196.218.227.241:995
185.250.148.74:2222
81.214.126.173:2222
68.186.192.69:443
92.59.35.196:2222
24.152.219.253:995
50.29.166.232:995
75.67.192.125:443
24.95.61.62:443
73.25.124.140:2222
64.121.114.87:443
151.205.102.42:443
72.240.200.181:2222
75.137.47.174:443
45.32.211.207:995
45.32.211.207:8443
149.28.98.196:2222
149.28.98.196:995
207.246.77.75:8443
45.63.107.192:995
149.28.99.97:443
45.77.117.108:2222
149.28.99.97:2222
45.32.211.207:2222
45.63.107.192:443
149.28.101.90:443
149.28.101.90:8443
149.28.99.97:995
96.253.46.210:443
83.196.56.65:2222
45.77.115.208:2222
45.77.115.208:8443
45.77.115.208:443
144.202.38.185:443
144.202.38.185:2222
45.32.211.207:443
144.202.38.185:995
149.28.98.196:443
149.28.101.90:2222
45.77.117.108:443
207.246.77.75:995
207.246.77.75:443
207.246.77.75:2222
149.28.101.90:995
45.77.117.108:995
45.77.117.108:8443
45.77.115.208:995
71.163.222.223:443
90.87.245.154:2222
207.246.116.237:995
207.246.116.237:443
45.63.107.192:2222
207.246.116.237:8443
207.246.116.237:2222
24.179.77.236:443
184.185.103.157:443
217.165.164.110:2222
213.122.113.120:443
193.248.221.184:2222
188.27.179.172:443
222.153.169.147:995
100.2.20.137:443
172.78.42.79:443
97.69.160.4:2222
105.198.236.101:443
98.192.185.86:443
186.144.33.73:443
96.61.23.88:995
86.220.60.247:2222
71.41.184.10:3389
175.143.92.16:443
46.149.81.250:443
98.252.118.134:443
92.96.3.180:2078
71.187.170.235:443
50.244.112.106:443
24.122.118.18:443
47.196.213.73:443
186.154.175.13:443
70.163.161.79:443
78.63.226.32:443
76.168.147.166:993
77.27.207.217:995
31.4.242.28:995
125.62.192.195:443
195.12.154.8:443
96.21.251.127:2222
71.199.192.62:443
70.168.130.172:995
82.12.157.95:995
209.210.187.52:995
209.210.187.52:443
67.6.12.4:443
189.222.59.177:443
174.104.22.30:443
142.117.191.18:2222
189.146.183.105:443
213.60.147.140:443
196.221.207.137:995
108.46.145.30:443
187.250.238.164:995
2.7.116.188:2222
195.43.173.70:443
106.250.150.98:443
45.67.231.247:443
83.110.103.152:443
83.110.9.71:2222
78.97.207.104:443
59.90.246.200:443
80.227.5.69:443
125.63.101.62:443
86.236.77.68:2222
109.106.69.138:2222
84.72.35.226:443
217.133.54.140:32100
197.161.154.132:443
89.137.211.239:995
74.222.204.82:995
122.148.156.131:995
156.223.110.23:443
144.139.166.18:443
202.185.166.181:443
76.94.200.148:995
71.63.120.101:443
196.151.252.84:443
202.188.138.162:443

Unpacked files

SH256 hash:

2d54a199d2329f31dc03d0861af70dfa6f70dc197cb06a2e69db1da5fbb4f9d5

MD5 hash:

e1098e62668a2664ec6ac6839c7f33bc

SHA1 hash:

1387ff62b8e0b8e7f6ca6ef0fe40c059da3114f8

Link:

https://www.unpac.me/results/2617c48d-dea0-4bbf-bd1b-04fd98b89446/

SH256 hash:

aee837a3ddd1b64840c5d62e6616471ead530a66c37140e6b1c5e1199d0e51f4

MD5 hash:

a1819ab456fdc693b2cdc167618e4b90

SHA1 hash:

ded97b8cc49d99b1b01c96b4dcd35a7b23926520

Link:

https://www.unpac.me/results/2617c48d-dea0-4bbf-bd1b-04fd98b89446/

SH256 hash:

7c6a9dc5626bd62584851b56ce9e386cf5a494e6c5c2d1e36032798edb9405b0

MD5 hash:

5c4c1023d8ed47504cc64deaef91e40e

SHA1 hash:

5b2cfc4f23aa8e4679d4434c73979c51f26c5486

Link:

https://www.unpac.me/results/2617c48d-dea0-4bbf-bd1b-04fd98b89446/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7c6a9dc5626bd62584851b56ce9e386cf5a494e6c5c2d1e36032798edb9405b0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

DLL dll 7c6a9dc5626bd62584851b56ce9e386cf5a494e6c5c2d1e36032798edb9405b0

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/1639684/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/190391/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample