MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 907b3cc7168067b2e2c4db2318cc9fa2ebc58963571c92665b447c447b6cc3a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 11
| SHA256 hash: | 907b3cc7168067b2e2c4db2318cc9fa2ebc58963571c92665b447c447b6cc3a1 |
|---|---|
| SHA3-384 hash: | 2b663bbe01a2144746167d036af979c529fcebebe482e26e879a937ddb08e5dd294785ac40dfdf35eb54bb9829905f98 |
| SHA1 hash: | c296266bf162eda7f605dfb12aa95f48cf75681d |
| MD5 hash: | e7eb785bdb9b7ebfe4c17caeb04fbb43 |
| humanhash: | georgia-earth-lithium-gee |
| File name: | outright.dat |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 722'248 bytes |
| First seen: | 2022-11-04 11:51:50 UTC |
| Last seen: | 2022-11-04 14:12:31 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | 94ceebbdab5be08fc1bb52107abbbb76 (1 x Quakbot) |
| ssdeep | 12288:m1hFLlWXKDqUkyQ8r12OkBlqMv20nxjxRuWRuiOCqvkajw:Kh9FD5pgOkBztxjxEdiOnvkajw |
| Threatray | 1'745 similar samples on MalwareBazaar |
| TLSH | T172E49E62B2A8C432D53216FC8D3762AC587BBD113D2C9C09BFD54F0D5E39A4136663AB |
| TrID | 47.6% (.EXE) Win32 Executable Delphi generic (14182/79/4) 15.1% (.EXE) Win32 Executable (generic) (4505/5/1) 10.0% (.MZP) WinArchiver Mountable compressed Archive (3000/1) 6.9% (.EXE) Win16/32 Executable Delphi generic (2072/23) 6.8% (.EXE) OS/2 Executable (generic) (2029/13) |
| File icon (PE): |  |
| dhash icon | 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner) |
| Reporter |  pr0xylife |
| Tags: | 1667543522 BB05 dll Qakbot Quakbot |
Intelligence
File Origin
# of uploads :
2
# of downloads :
223
Origin country :
USVendor Threat Intelligence
Detection:
QakBot
Result
Verdict:
Suspicious
Maliciousness:
Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching a process
Modifying an executable file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Verdict:
Malicious
Threat name:
Win32.Backdoor.Quakbot
Status:
Malicious
First seen:
2022-11-04 11:52:11 UTC
File Type:
PE (Dll)
Extracted files:
38
AV detection:
18 of 26 (69.23%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Label(s):
qakbot
Similar samples:
+ 1'735 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:bb05 campaign:1667543522 banker stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Program crash
Qakbot/Qbot
Malware Config
C2 Extraction:
190.199.161.250:993
92.25.139.40:443
157.231.42.190:995
186.73.140.43:443
70.66.199.12:443
216.82.134.218:443
174.77.209.5:443
139.216.164.122:443
91.169.12.198:32100
139.5.239.14:443
50.37.149.215:443
74.92.243.113:995
74.92.243.113:50000
49.175.72.56:443
24.142.218.202:443
136.232.184.134:995
181.118.183.103:443
174.101.111.4:443
47.34.30.133:443
41.44.11.227:995
89.216.114.179:443
80.0.74.165:443
92.239.222.177:443
94.60.141.48:995
64.207.237.118:443
72.53.103.56:443
174.104.184.149:443
203.217.65.6:443
86.225.214.138:2222
45.49.137.80:443
76.68.34.167:2222
92.24.200.226:995
144.202.15.58:443
74.33.84.227:443
201.102.237.203:443
41.96.68.5:443
73.29.92.128:443
84.209.52.11:443
50.68.204.71:443
58.247.115.126:995
201.192.179.221:443
105.184.161.175:443
212.251.122.147:995
2.103.22.24:443
41.230.166.34:995
65.25.116.200:443
99.254.117.30:443
184.153.132.82:443
154.247.15.173:995
154.247.15.173:32103
154.247.15.173:993
193.3.19.137:443
142.115.159.36:2222
190.18.236.175:443
91.138.17.202:443
67.10.175.47:2222
84.113.121.103:443
157.231.42.190:443
73.165.119.20:443
190.24.45.24:995
187.199.171.252:32103
73.36.196.11:443
75.156.125.215:995
50.68.204.71:993
36.152.128.7:2078
24.69.87.61:443
58.162.223.233:443
94.63.65.146:443
75.99.125.238:2222
190.36.189.154:2222
50.68.204.71:995
24.4.239.157:443
174.0.224.214:443
24.206.27.39:443
136.244.25.165:443
24.64.114.59:2222
90.104.22.28:2222
84.35.26.14:995
197.204.243.188:443
175.205.2.54:443
184.162.156.115:2222
190.79.133.56:2222
24.64.114.59:3389
75.98.154.19:443
85.61.165.153:2222
200.233.108.153:995
70.181.149.227:443
85.59.61.52:2222
70.64.77.115:443
151.237.76.117:443
72.80.249.39:995
190.29.228.61:443
151.30.53.233:443
46.229.194.17:443
73.60.227.230:443
75.141.227.169:443
173.238.202.233:443
50.86.217.209:443
98.145.23.67:443
173.32.181.236:443
87.220.68.51:2222
187.135.153.221:2222
190.204.83.110:2222
58.186.75.42:443
206.1.199.69:2087
190.27.77.14:995
46.190.93.247:50000
91.165.188.74:50000
94.49.5.116:443
110.23.76.9:2222
174.58.146.57:443
190.74.248.136:443
73.88.173.113:443
190.203.11.218:443
24.232.88.41:443
27.33.237.105:443
173.209.185.159:443
86.157.12.148:443
92.25.139.40:443
157.231.42.190:995
186.73.140.43:443
70.66.199.12:443
216.82.134.218:443
174.77.209.5:443
139.216.164.122:443
91.169.12.198:32100
139.5.239.14:443
50.37.149.215:443
74.92.243.113:995
74.92.243.113:50000
49.175.72.56:443
24.142.218.202:443
136.232.184.134:995
181.118.183.103:443
174.101.111.4:443
47.34.30.133:443
41.44.11.227:995
89.216.114.179:443
80.0.74.165:443
92.239.222.177:443
94.60.141.48:995
64.207.237.118:443
72.53.103.56:443
174.104.184.149:443
203.217.65.6:443
86.225.214.138:2222
45.49.137.80:443
76.68.34.167:2222
92.24.200.226:995
144.202.15.58:443
74.33.84.227:443
201.102.237.203:443
41.96.68.5:443
73.29.92.128:443
84.209.52.11:443
50.68.204.71:443
58.247.115.126:995
201.192.179.221:443
105.184.161.175:443
212.251.122.147:995
2.103.22.24:443
41.230.166.34:995
65.25.116.200:443
99.254.117.30:443
184.153.132.82:443
154.247.15.173:995
154.247.15.173:32103
154.247.15.173:993
193.3.19.137:443
142.115.159.36:2222
190.18.236.175:443
91.138.17.202:443
67.10.175.47:2222
84.113.121.103:443
157.231.42.190:443
73.165.119.20:443
190.24.45.24:995
187.199.171.252:32103
73.36.196.11:443
75.156.125.215:995
50.68.204.71:993
36.152.128.7:2078
24.69.87.61:443
58.162.223.233:443
94.63.65.146:443
75.99.125.238:2222
190.36.189.154:2222
50.68.204.71:995
24.4.239.157:443
174.0.224.214:443
24.206.27.39:443
136.244.25.165:443
24.64.114.59:2222
90.104.22.28:2222
84.35.26.14:995
197.204.243.188:443
175.205.2.54:443
184.162.156.115:2222
190.79.133.56:2222
24.64.114.59:3389
75.98.154.19:443
85.61.165.153:2222
200.233.108.153:995
70.181.149.227:443
85.59.61.52:2222
70.64.77.115:443
151.237.76.117:443
72.80.249.39:995
190.29.228.61:443
151.30.53.233:443
46.229.194.17:443
73.60.227.230:443
75.141.227.169:443
173.238.202.233:443
50.86.217.209:443
98.145.23.67:443
173.32.181.236:443
87.220.68.51:2222
187.135.153.221:2222
190.204.83.110:2222
58.186.75.42:443
206.1.199.69:2087
190.27.77.14:995
46.190.93.247:50000
91.165.188.74:50000
94.49.5.116:443
110.23.76.9:2222
174.58.146.57:443
190.74.248.136:443
73.88.173.113:443
190.203.11.218:443
24.232.88.41:443
27.33.237.105:443
173.209.185.159:443
86.157.12.148:443
Unpacked files
SH256 hash:
3b1a1382b328ee6d688f5b3a80a0f5d4956bca635d1f26d0dffbc7acfcd5de5c
MD5 hash:
c77e5c4a69fa337321b807b8648583cc
SHA1 hash:
9a6926c7e505ff54bc963abeb55347103864e259
SH256 hash:
00ccb81a87edee4c73b6f6984ddc4ae72d3372858bd1ae1cf4f8824746efe888
MD5 hash:
354f81a72e3e2ddc03fa86f155b19474
SHA1 hash:
96b65805c3a2fde0a4b9d4570d1a39499c0c68b0
Detections:
Qakbot
win_qakbot_auto
SH256 hash:
907b3cc7168067b2e2c4db2318cc9fa2ebc58963571c92665b447c447b6cc3a1
MD5 hash:
e7eb785bdb9b7ebfe4c17caeb04fbb43
SHA1 hash:
c296266bf162eda7f605dfb12aa95f48cf75681d
Malware family:
CryptOne
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | cobalt_strike_tmp01925d3f |
|---|---|
| Author: | The DFIR Report |
| Description: | files - file ~tmp01925d3f.exe |
| Reference: | https://thedfirreport.com |
| Rule name: | meth_get_eip |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | meth_stackstrings |
|---|---|
| Author: | Willi Ballenthin |
| Rule name: | QakBot |
|---|---|
| Author: | kevoreilly |
| Description: | QakBot Payload |
| Rule name: | unpacked_qbot |
|---|---|
| Description: | Detects unpacked or memory-dumped QBot samples |
| Rule name: | win_qakbot_auto |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.qakbot. |
| Rule name: | win_qakbot_malped |
|---|---|
| Author: | Felix Bilstein - yara-signator at cocacoding dot com |
| Description: | Detects win.qakbot. |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.