MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8ca16991684f7384c12b6622b8d1bcd23bc27f186f499c2059770ddd3031f274. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 11
| SHA256 hash: | 8ca16991684f7384c12b6622b8d1bcd23bc27f186f499c2059770ddd3031f274 |
|---|---|
| SHA3-384 hash: | 78033c43c8661095bd5a0bf436a9e46dabc0552457995204540643554d2f583f2a83349853bb8cb33dfc6618554a7d1a |
| SHA1 hash: | 80f524f04ef866cbc871b55f3d7e5786074671a4 |
| MD5 hash: | 0cffee80be59c6316a7132446b0da699 |
| humanhash: | angel-oven-alpha-lima |
| File name: | resemblance.tmp |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 707'584 bytes |
| First seen: | 2022-11-17 15:19:44 UTC |
| Last seen: | 2022-11-17 16:53:03 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 8b0d4d20617bb1b305b5da35596be37f (2 x Quakbot) |
| ssdeep | 12288:sjGfBl7YUWlaVxbYUGOpGPq1Tu/VxdZlUP9Xq4F/9:sjk1W8wWpD9u/VLM9Xq4n |
| TLSH | T126E42806DD40F27EE9F80571461D08338E2A1CEF22678CA76675395679BF2A09CFE427 |
| TrID | 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 15.9% (.EXE) Win64 Executable (generic) (10523/12/4) 9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 7.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 6.8% (.EXE) Win32 Executable (generic) (4505/5/1) |
| File icon (PE): |  |
| dhash icon | f0f0ececc8f071b2 (3 x Quakbot, 1 x SystemBC, 1 x LummaStealer) |
| Reporter |  pr0xylife |
| Tags: | 1668683197 BB06 dll Qakbot Quakbot |
Intelligence
File Origin
# of uploads :
2
# of downloads :
258
Origin country :
IEVendor Threat Intelligence
Detection:
QakBot
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Modifying an executable file
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Verdict:
Malicious
Threat name:
Win32.Trojan.KBot
Status:
Malicious
First seen:
2022-11-17 15:20:16 UTC
File Type:
PE (Dll)
Extracted files:
35
AV detection:
19 of 26 (73.08%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
qakbot
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:bb06 campaign:1668683197 banker stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
23.240.47.58:995
12.172.173.82:465
91.169.12.198:32100
94.63.65.146:443
80.13.179.151:2222
64.207.237.118:443
24.206.27.39:443
83.114.60.6:2222
86.171.75.63:443
86.195.32.149:2222
170.253.25.35:443
92.185.204.18:2078
157.231.42.190:995
170.249.59.153:443
174.101.111.4:443
116.74.163.152:443
76.80.180.154:995
180.151.104.143:443
86.130.9.167:2222
86.99.15.243:2222
90.104.22.28:2222
172.117.139.142:995
103.141.50.117:995
176.142.207.63:443
71.183.236.133:443
131.106.168.223:443
190.75.110.239:443
70.66.199.12:443
183.87.31.34:443
83.110.223.247:443
47.34.30.133:443
71.247.10.63:995
92.207.132.174:2222
89.129.109.27:2222
12.172.173.82:21
87.202.101.164:50000
2.99.47.198:2222
154.247.95.119:2078
197.148.17.17:2078
37.14.229.220:2222
78.247.21.20:443
112.141.184.246:995
142.161.27.232:2222
71.247.10.63:50003
108.6.249.139:443
92.239.81.124:443
184.176.154.83:995
184.153.132.82:443
74.66.134.24:443
24.64.114.59:3389
105.184.161.242:443
73.36.196.11:443
82.31.37.241:443
24.116.45.121:443
213.67.255.57:2222
200.93.14.206:2222
91.254.215.167:443
87.220.205.14:2222
92.27.86.48:2222
73.230.28.7:443
176.151.15.101:443
24.64.114.59:2222
86.165.15.180:2222
66.191.69.18:995
175.205.2.54:443
64.121.161.102:443
87.99.116.47:443
180.156.240.239:995
12.172.173.82:22
50.68.204.71:995
213.91.235.146:443
174.77.209.5:443
76.127.192.23:443
50.68.204.71:443
109.11.175.42:2222
199.83.165.233:443
91.68.227.219:443
45.248.169.101:443
85.59.61.52:2222
85.139.176.42:2222
82.34.170.37:443
157.231.42.190:443
76.20.42.45:443
27.110.134.202:995
89.115.196.99:443
83.11.84.105:2222
12.172.173.82:2087
12.172.173.82:443
181.118.183.116:443
174.45.15.123:443
77.126.81.208:443
92.106.70.62:2222
82.121.73.56:2222
173.239.94.212:443
187.199.224.16:32103
183.82.100.110:2222
186.188.2.193:443
41.62.227.225:443
75.99.125.238:2222
2.84.98.228:2222
82.121.237.106:2222
100.6.8.7:443
85.241.180.94:443
79.37.204.67:443
217.128.91.196:2222
58.247.115.126:995
12.172.173.82:993
98.147.155.235:443
102.157.69.217:995
212.251.122.147:995
92.137.74.174:2222
24.228.132.224:2222
69.119.123.159:2222
89.79.229.50:443
47.176.30.75:443
174.104.184.149:443
173.32.181.236:443
74.92.243.113:50000
12.172.173.82:995
58.186.75.42:443
12.172.173.82:465
91.169.12.198:32100
94.63.65.146:443
80.13.179.151:2222
64.207.237.118:443
24.206.27.39:443
83.114.60.6:2222
86.171.75.63:443
86.195.32.149:2222
170.253.25.35:443
92.185.204.18:2078
157.231.42.190:995
170.249.59.153:443
174.101.111.4:443
116.74.163.152:443
76.80.180.154:995
180.151.104.143:443
86.130.9.167:2222
86.99.15.243:2222
90.104.22.28:2222
172.117.139.142:995
103.141.50.117:995
176.142.207.63:443
71.183.236.133:443
131.106.168.223:443
190.75.110.239:443
70.66.199.12:443
183.87.31.34:443
83.110.223.247:443
47.34.30.133:443
71.247.10.63:995
92.207.132.174:2222
89.129.109.27:2222
12.172.173.82:21
87.202.101.164:50000
2.99.47.198:2222
154.247.95.119:2078
197.148.17.17:2078
37.14.229.220:2222
78.247.21.20:443
112.141.184.246:995
142.161.27.232:2222
71.247.10.63:50003
108.6.249.139:443
92.239.81.124:443
184.176.154.83:995
184.153.132.82:443
74.66.134.24:443
24.64.114.59:3389
105.184.161.242:443
73.36.196.11:443
82.31.37.241:443
24.116.45.121:443
213.67.255.57:2222
200.93.14.206:2222
91.254.215.167:443
87.220.205.14:2222
92.27.86.48:2222
73.230.28.7:443
176.151.15.101:443
24.64.114.59:2222
86.165.15.180:2222
66.191.69.18:995
175.205.2.54:443
64.121.161.102:443
87.99.116.47:443
180.156.240.239:995
12.172.173.82:22
50.68.204.71:995
213.91.235.146:443
174.77.209.5:443
76.127.192.23:443
50.68.204.71:443
109.11.175.42:2222
199.83.165.233:443
91.68.227.219:443
45.248.169.101:443
85.59.61.52:2222
85.139.176.42:2222
82.34.170.37:443
157.231.42.190:443
76.20.42.45:443
27.110.134.202:995
89.115.196.99:443
83.11.84.105:2222
12.172.173.82:2087
12.172.173.82:443
181.118.183.116:443
174.45.15.123:443
77.126.81.208:443
92.106.70.62:2222
82.121.73.56:2222
173.239.94.212:443
187.199.224.16:32103
183.82.100.110:2222
186.188.2.193:443
41.62.227.225:443
75.99.125.238:2222
2.84.98.228:2222
82.121.237.106:2222
100.6.8.7:443
85.241.180.94:443
79.37.204.67:443
217.128.91.196:2222
58.247.115.126:995
12.172.173.82:993
98.147.155.235:443
102.157.69.217:995
212.251.122.147:995
92.137.74.174:2222
24.228.132.224:2222
69.119.123.159:2222
89.79.229.50:443
47.176.30.75:443
174.104.184.149:443
173.32.181.236:443
74.92.243.113:50000
12.172.173.82:995
58.186.75.42:443
Unpacked files
SH256 hash:
5e6ac6ac43c0e01704a152cf0e1a711057a9c4992ec61e80e6975b5baf9d4332
MD5 hash:
4dced709ea2d2602ec420ac391650fba
SHA1 hash:
8029bf4189ad06a7a22b36143db276ddc47623c4
SH256 hash:
95c2cc28837a8e8c9717d9e68bd2441201197632b814915a1adf8f82183860b1
MD5 hash:
25b127c2c99e79180ba596fb23de442a
SHA1 hash:
e728b8971bf9a623274d4f1013c8c8687b61f97f
Detections:
Qakbot
win_qakbot_auto
SH256 hash:
8ca16991684f7384c12b6622b8d1bcd23bc27f186f499c2059770ddd3031f274
MD5 hash:
0cffee80be59c6316a7132446b0da699
SHA1 hash:
80f524f04ef866cbc871b55f3d7e5786074671a4
Malware family:
QBot
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | BitcoinAddress |
|---|---|
| Author: | Didier Stevens (@DidierStevens) |
| Description: | Contains a valid Bitcoin address |
| Rule name: | cobalt_strike_tmp01925d3f |
|---|---|
| Author: | The DFIR Report |
| Description: | files - file ~tmp01925d3f.exe |
| Reference: | https://thedfirreport.com |
| Rule name: | QakBot |
|---|---|
| Author: | kevoreilly |
| Description: | QakBot Payload |
| Rule name: | unpacked_qbot |
|---|---|
| Description: | Detects unpacked or memory-dumped QBot samples |
| Rule name: | win_qakbot_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.qakbot. |
| Rule name: | win_qakbot_malped |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.qakbot. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.