MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8a7ba0389467eb3c26a2f0e1fd64f5d23e3ef8d04a8b947251c52b778f507308. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8a7ba0389467eb3c26a2f0e1fd64f5d23e3ef8d04a8b947251c52b778f507308
SHA3-384 hash: 2a7785185e871a7493c28b7ff8441035051a01351f2001a902df59b030d021913195ab8d3269f6846ab87defcb53d082
SHA1 hash: 1de0e312c2e548bd51c4917a714355c2347454cb
MD5 hash: c7cddf1a0c390a58944f7b909019c64b
humanhash: fourteen-comet-avocado-juliet
File name:c7cddf1a0c390a58944f7b909019c64b
Download: download sample
Signature Quakbot
Create hunting rule
File size:844'800 bytes
First seen:2021-10-07 13:55:27 UTC
Last seen:2021-10-07 15:09:49 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 0bb088133cc4ca3c25a91945e93e2571 (2 x Quakbot)
ssdeep 24576:itjCOuBER57hemWxOVCy632yHAMnbOMmpK6kMXn9vM+GGVdrhDflIF:idr57hemWxOVCytCrbxmpvX90+XVd9Du
Threatray 226 similar samples on MalwareBazaar
TLSH T1E9057D013A84D431E7EA55318E29D6E40A5C7D14DEB0A5CFBAE07F2F2AB89F3D215316
Reporter malwarelabnet
Tags:dll Qakbot Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
249
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/195868/
Detection(s):
SecuriteInfo.com.Trojan-Banker.UrSnif.7010.21505.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
greyware
Link:
https://www.filescan.io/uploads/615efc7698a6280f3933b143/reports/2b31d727-e7ab-4d4f-befd-bbfabbac4c4a/overview
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f0c344d3-8407-45ee-bf27-6e14b65d090b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8a7ba0389467eb3c26a2f0e1fd64f5d23e3ef8d04a8b947251c52b778f507308/
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
gozi
Create hunting rule
Similar samples:
05bd9cbf9725884979435d684a7268a75eb05d5916dc85325b0286e9ed71a038
Quakbot
0d1850712e82653dc7112d8bdae533b898a68f696c9b66dfe8f93120f73af191
Quakbot
12c388d2d4af3d8303e0fcf7136164317130cfb294c961f88f6cf4641c4f074a
Quakbot
2386996976337ff4bc0e5624822dcc7bd97d847b0e546f58068c35c1808276b0
Quakbot
241e148a3dbbe5e0032079887d3b714128736a3d5ba3f5fc253d7805d8349925
Quakbot
3889086935fd4818ec652f34cc8dfde7a071492fe5a50f5b523bdbe9acaa2861
Quakbot
3db836aa01204f3f894360b086384595b480b8c45472f97214d1676091851c9f
Quakbot
6f63742c25fd3a2dae5995f182254c253003066488ef86e754f661e8ba1d76fd
Quakbot
b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
Quakbot
f45a72880d244adbc4e7d41517e790b291ca235c7655f887d5eed31373516abb
Quakbot
+ 216 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama111 campaign:1633590450 banker stealer trojan
Link:
https://tria.ge/reports/211007-q8p2dsceb9/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
37.210.152.224:995
201.93.111.2:995
202.134.178.157:443
89.101.97.139:443
73.52.50.32:443
188.55.235.110:995
27.223.92.142:995
181.118.183.94:443
136.232.34.70:443
186.32.163.199:443
72.173.78.211:443
76.25.142.196:443
120.150.218.241:995
185.250.148.74:443
89.137.52.44:443
66.103.170.104:2222
188.50.169.158:443
174.54.193.186:443
103.148.120.144:443
140.82.49.12:443
216.201.162.158:443
73.230.205.91:443
200.232.214.222:995
103.142.10.177:443
45.46.53.140:2222
124.123.42.115:2222
74.72.237.54:443
41.228.22.180:443
209.142.97.161:995
122.11.220.212:2222
78.191.58.219:995
94.200.181.154:443
47.22.148.6:443
96.57.188.174:2078
68.13.157.69:0
209.50.20.255:443
98.157.235.126:443
173.21.10.71:2222
73.151.236.31:443
71.74.12.34:443
199.27.127.129:443
75.75.179.226:443
167.248.117.81:443
67.165.206.193:993
47.40.196.233:2222
72.252.201.69:443
86.8.177.143:443
181.4.53.6:465
109.12.111.14:443
24.171.50.5:443
24.139.72.117:443
24.55.112.61:443
24.229.150.54:995
77.57.204.78:443
81.250.153.227:2222
49.33.237.65:443
66.177.215.152:50010
177.170.201.134:995
75.188.35.168:443
2.222.167.138:443
120.151.47.189:443
81.241.252.59:2078
173.25.162.221:443
201.6.246.227:995
66.177.215.152:443
217.17.56.163:2222
202.165.32.158:2222
39.52.229.8:995
42.60.70.14:443
73.140.38.124:443
167.248.100.227:443
63.70.164.200:443
69.30.186.190:443
189.131.221.201:443
68.204.7.158:443
181.84.114.46:443
167.248.99.149:443
177.94.21.110:995
50.54.32.149:443
189.224.181.39:443
24.119.214.7:443
63.70.164.200:995
177.94.125.59:995
82.18.173.253:2222
73.130.180.25:443
217.17.56.163:2078
162.244.227.34:443
75.66.88.33:443
206.47.134.234:2222
167.248.54.34:2222
73.77.87.137:443
181.4.53.6:443
190.198.206.189:2222
167.248.111.245:443
96.46.103.226:443
73.25.124.140:2222
24.152.219.253:995
68.186.192.69:443
162.210.220.137:443
174.54.58.170:443
103.246.130.114:1194
103.246.130.35:21
103.246.130.2:20
103.246.130.122:20
105.198.236.99:443
103.157.122.198:995
4.34.193.180:995
159.2.51.200:2222
110.174.64.179:995
187.101.25.96:32100
76.84.230.103:443
174.59.35.191:443
173.63.245.129:443
68.117.229.117:443
75.163.81.130:995
76.84.32.159:443
147.92.51.49:443
76.84.226.17:443
68.13.157.69:443
167.248.126.223:443
72.196.22.184:443
98.22.92.139:995
97.98.130.50:443
196.117.224.53:995
191.191.38.8:443
188.210.210.122:443
96.46.103.109:2222
37.117.191.19:2222
197.90.137.161:61201
24.32.174.175:443
76.84.225.21:443
78.145.153.73:995
69.30.190.105:995
167.248.81.60:443
69.80.113.148:443
217.17.56.163:443
62.23.194.38:443
62.23.194.41:995
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
69.253.197.100:443
174.59.242.9:443
Unpacked files
SH256 hash:
f1c3510086f2cb2b4d923d5e35c09ae77112000f0054356472a1654418c98114
MD5 hash:
2461383d2184f77d8124338895c2f8fd
SHA1 hash:
a4afa33dbbff07790e47f0f5bcd6a1a4d8853078
Link:
https://www.unpac.me/results/48990f3f-e169-4677-a6e9-99ec54eeb602/
SH256 hash:
a7891b6f7bb1e2010d8b4adf8ee4fc8ea829eddb42f173a667452de6a1d68fb4
MD5 hash:
b6a05878e1a4cc9242770e73606c08f1
SHA1 hash:
922a3a5db9c23c4ea733b761d8dd55e7f9563246
Link:
https://www.unpac.me/results/48990f3f-e169-4677-a6e9-99ec54eeb602/
SH256 hash:
8a7ba0389467eb3c26a2f0e1fd64f5d23e3ef8d04a8b947251c52b778f507308
MD5 hash:
c7cddf1a0c390a58944f7b909019c64b
SHA1 hash:
1de0e312c2e548bd51c4917a714355c2347454cb
Link:
https://www.unpac.me/results/48990f3f-e169-4677-a6e9-99ec54eeb602/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8a7ba0389467eb3c26a2f0e1fd64f5d23e3ef8d04a8b947251c52b778f507308

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/195868/

Comments