MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 841670686930fb7a6a12fe750c96d0bd2e3976bf61d9d738aa7f1e8591f8a28c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 841670686930fb7a6a12fe750c96d0bd2e3976bf61d9d738aa7f1e8591f8a28c
SHA3-384 hash: 5de40ace05ed656a7e7172abb24e37e0c5dd58be348e2383a597077375fc915235c5aebbe86f04330aa06f60a64b25d7
SHA1 hash: c657f8bb068421181aefd12d4bd35c059d432f8c
MD5 hash: 306dd7e7c3e0ac3d079ffc491199e5d0
humanhash: gee-alpha-michigan-arkansas
File name:841670686930fb7a6a12fe750c96d0bd2e3976bf61d9d738aa7f1e8591f8a28c
Download: download sample
Signature Quakbot
Create hunting rule
File size:1'200'128 bytes
First seen:2022-02-16 15:54:31 UTC
Last seen:2022-02-16 18:11:15 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 6599803705113bca9a96751151ee2d1e (5 x Quakbot)
ssdeep 24576:+xQOweHoWtXSXbItIyboRus6FYY22OlWc971Zkqtu2K0FCF:GYaF2ch122S9k2K
Threatray 17 similar samples on MalwareBazaar
TLSH T1E8457C32B1C191BFC4B2367C9D6A719A5821BD215D2CDC4D7BD84F5E0A3E5827B3228E
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter malwarelabnet
Tags:dll obama156 Qakbot Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
161
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/241955/
Detection(s):
SecuriteInfo.com.UDS.Trojan.Win32.Injuke.gen.23199.12493.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Modifying an executable file
Searching for synchronization primitives
Creating a process with a hidden window
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/620d1e5fa2660f3bb9e7300c/reports/4d06a32c-c994-4429-ab2e-f9c2355ba2b9/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/841670686930fb7a6a12fe750c96d0bd2e3976bf61d9d738aa7f1e8591f8a28c/
Threat name:
Win32.Trojan.BotX
Create hunting rule
Status:
Malicious
First seen:
2022-02-16 15:55:12 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8
Quakbot
790951787b259b98ea0f3b7face9c805643bd5e36b2d8a9d92d6d20a7107971b
Quakbot
ac435e965d0ac8c246ea9707d9e4545d287879d665479ce3dcfeedc914f25809
Quakbot
cd8a94e42e7119a3f1b5117151b7bb2fe4a777f221581b2dae0c2cf0e8ddedf2
Quakbot
d8d7d4ffaefc24dae69840816ce840570744f16d54f43fdb73d28e8456483750
Quakbot
e55a662e05fdc1e0c8570564bfcdb0d7cbec3bf5eca101ab12ac2997998c2aa9
Quakbot
e9553ac49999a213ddf6001564a5cb87225f2b5b91cb201c8a415f8dbb1eb623
Quakbot
ee44ca0c691190a878ec0ab55096eeb9855590d9398c95c837c6add9fac2ee32
Quakbot
f2bd4c95a2c6850d4f00438069a65dd740871dc56eee4e523f819a814104a9f6
Quakbot
f7664b0c71230005f8e2390a1bd128b6bae71e4c697d80ddcfe8fa34de8d62a6
Quakbot
+ 7 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama156 campaign:1645009013 banker evasion stealer trojan
Link:
https://tria.ge/reports/220216-tcsdesbhd2/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Loads dropped DLL
Qakbot/Qbot
Suspicious use of NtCreateProcessExOtherParentProcess
Windows security bypass
Malware Config
C2 Extraction:
103.116.178.85:443
47.180.172.159:443
197.92.132.79:443
120.150.218.241:995
32.221.231.1:443
75.99.168.194:61201
89.211.191.219:2222
182.191.92.203:995
41.84.233.153:443
78.96.235.245:443
45.9.20.200:443
75.156.151.34:443
2.50.41.69:61200
31.35.28.29:443
114.79.148.170:443
39.49.125.85:995
67.209.195.198:443
78.87.41.5:995
182.176.180.73:443
217.164.115.166:2222
24.152.219.253:995
96.246.158.154:995
190.73.3.148:2222
41.228.22.180:443
190.206.211.182:443
188.55.243.70:995
92.177.45.46:2078
180.233.150.134:995
1.161.88.84:443
103.17.101.139:995
111.125.245.116:995
128.106.122.39:443
66.230.104.103:443
197.89.20.13:443
82.152.39.39:443
47.180.172.159:50010
102.132.145.147:443
47.180.172.159:993
196.206.66.89:443
24.178.196.158:2222
140.82.49.12:443
86.97.247.79:1194
89.101.97.139:443
86.97.247.79:2222
37.211.176.26:61202
209.210.95.228:32100
75.99.168.194:443
72.66.116.235:995
181.118.183.28:443
149.135.101.20:443
1.161.88.84:995
74.15.2.252:2222
136.143.11.232:443
175.137.153.178:443
103.142.10.177:443
39.44.150.120:995
206.217.0.154:995
217.128.171.34:2222
105.184.116.32:995
176.67.56.94:443
102.65.38.67:443
139.64.13.189:443
96.21.251.127:2222
86.98.156.24:32101
86.98.156.45:993
212.34.15.205:443
45.241.208.225:995
136.232.34.70:443
177.205.28.80:443
208.107.221.224:443
78.191.55.146:995
86.98.49.16:443
71.74.12.34:443
173.21.10.71:2222
67.165.206.193:993
76.25.142.196:443
217.128.122.65:2222
189.146.51.56:443
24.53.49.240:443
69.14.172.24:443
72.12.115.90:22
139.64.34.193:443
73.151.236.31:443
109.12.111.14:443
72.12.115.90:995
72.12.115.90:2083
70.51.137.204:2222
100.1.108.246:443
72.12.115.90:990
184.149.30.83:2222
108.4.67.252:443
161.142.54.62:443
72.12.115.90:993
72.12.115.90:2078
72.12.115.90:465
72.12.115.90:3389
75.188.35.168:443
72.12.115.90:443
70.45.27.254:443
86.198.170.170:2222
201.40.225.216:443
72.252.201.34:990
72.252.201.34:995
45.46.53.140:2222
31.215.206.13:443
89.86.33.217:443
41.205.12.24:443
68.204.7.158:443
117.248.109.38:21
24.222.20.254:443
89.137.52.44:443
67.69.166.79:2222
2.50.166.55:995
86.98.10.175:995
122.96.42.131:2222
75.67.73.144:443
73.59.201.174:443
96.37.113.36:993
41.230.62.211:993
38.70.253.226:2222
109.51.132.148:995
76.23.237.163:995
220.255.25.1:2222
82.41.63.217:443
86.97.161.184:443
184.100.174.73:443
87.71.18.6:443
218.101.110.3:995
94.60.254.81:443
103.27.22.162:995
78.101.202.183:443
37.177.81.142:995
103.139.242.30:990
201.172.31.135:80
40.134.247.125:995
113.28.253.9:995
41.86.42.158:995
5.32.41.46:443
78.164.40.62:995
105.184.195.32:995
217.128.93.27:2222
80.6.192.58:443
39.52.253.188:995
103.139.242.30:993
75.169.34.158:443
31.215.29.238:443
Unpacked files
SH256 hash:
d9f37fb1b90787f0937f0dc459400fad6dffbe408b611ff45d1cd54764b648b0
MD5 hash:
03a4e1c22fed052ad931ad8d222cacc9
SHA1 hash:
33ad51cdfc78875772becee1e84226393b72fd9c
Link:
https://www.unpac.me/results/767c4e7e-005b-4db2-8fb7-5fa7aeba868e/
SH256 hash:
ad2f417ba64661ec285e14aaddea49cc6e9e41d492ed8d2ac0ac50c00fede5f1
MD5 hash:
afa3e64cc7630942151d414d3fe472a6
SHA1 hash:
2b8f8a2a408b45461fabfea3b5197ff0e204543a
Link:
https://www.unpac.me/results/767c4e7e-005b-4db2-8fb7-5fa7aeba868e/
SH256 hash:
841670686930fb7a6a12fe750c96d0bd2e3976bf61d9d738aa7f1e8591f8a28c
MD5 hash:
306dd7e7c3e0ac3d079ffc491199e5d0
SHA1 hash:
c657f8bb068421181aefd12d4bd35c059d432f8c
Link:
https://www.unpac.me/results/767c4e7e-005b-4db2-8fb7-5fa7aeba868e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/841670686930fb7a6a12fe750c96d0bd2e3976bf61d9d738aa7f1e8591f8a28c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/241955/

Comments