MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d2418d362dfacdb5efdf08a6c3a7f5e8f279670633676333f0466ff8158e5ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 5

Intelligence 5 IOCs YARA File information Comments

SHA256 hash:	8d2418d362dfacdb5efdf08a6c3a7f5e8f279670633676333f0466ff8158e5ff
SHA3-384 hash:	f9e69e5a8f661880a5a6cde18d6f4bdb994f4ab4946f683b4e13c877a00f7af7bb818be1f20a7a9d002e3a4696bf88ae
SHA1 hash:	2ba9669d94a5335496f903f84521aead167e0fdb
MD5 hash:	c65b7e056be7a11f0eadca642e6df3e4
humanhash:	oscar-pennsylvania-hot-idaho
File name:	c65b7e056be7a11f0eadca642e6df3e4.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	768'512 bytes
First seen:	2021-09-28 13:14:16 UTC
Last seen:	2021-09-28 14:06:33 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	57775f1d5f7cb33885211ff521ef0102 (3 x Quakbot)
ssdeep	12288:vV75XRqXnVyGXpI7IFHpsqJtjA42je3kyS6wEB35c+C:wXnVyy5WIkBy3kySqBpJ
Threatray	173 similar samples on MalwareBazaar
TLSH	T1E0F42A007A54E414F6B91A758E6EE1E8061C7E449FB4A0CF79D03F8F6A3A9E2D931317
Reporter	abuse_ch
Tags:	1632821932 dll obama105 Qakbot qbot Quakbot

abuse_ch

Quakbot payload URLs:
http://190.14.37.187/44467.6645570602.dat
http://94.140.112.126/44467.6645570602.dat
http://185.141.27.213/44467.6645570602.dat

Quakbot C2s:
120.151.47.189:443
41.228.22.180:443
39.52.241.3:995
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
196.217.156.63:995
120.150.218.241:995
95.77.223.148:443
185.250.148.74:443
181.118.183.94:443
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
76.25.142.196:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443

Intelligence

File Origin

# of uploads :

# of downloads :

279

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.StaticAI-SuspiciousPE.11223.27585.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Malware family:

Qakbot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/df93d9be-492a-431b-a834-48b1822a26da

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8d2418d362dfacdb5efdf08a6c3a7f5e8f279670633676333f0466ff8158e5ff/

Verdict:

malicious

Label(s):

qakbot

gozi

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:obama105 campaign:1632821932 banker evasion stealer trojan

Link:

https://tria.ge/reports/210928-qg8pescbfk/

Behaviour

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Qakbot/Qbot

Windows security bypass

Malware Config

C2 Extraction:

120.151.47.189:443
41.228.22.180:443
39.52.241.3:995
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
196.217.156.63:995
120.150.218.241:995
95.77.223.148:443
185.250.148.74:443
181.118.183.94:443
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
76.25.142.196:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443