MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b
SHA3-384 hash:	8a9960120153cb103f53b29f01f46ee89fecdfcba9bb6652f86203d05f98cc84fa5fcfdff5732c7a5ead7d85379a15a3
SHA1 hash:	24b38e564c4027dbf26ba3bf766335c5be029faf
MD5 hash:	7a35246c94d5dd27aff56a7862b1d33e
humanhash:	quiet-ohio-eight-sink
File name:	7a35246c94d5dd27aff56a7862b1d33e.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	387'072 bytes
First seen:	2021-09-27 17:45:20 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	ef258cd2a69e4871222e8a6651dd9af8 (8 x Quakbot)
ssdeep	3072:Do6vBnby4Yx0XjFFzPQ0MslzERfQB24hLxBVi/b/9+PdpiWC35ol/uwfTuT2b2MW:vs6Xpq0H3Jhds/9+qC/zfTPLg
Threatray	164 similar samples on MalwareBazaar
TLSH	T189846E27B7CEC812FB771FBFB2838A1455F2AD932123512E15E0B614F976A702992770
Reporter	abuse_ch
Tags:	dll obama104 Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

292

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/192240/

Detection(s):

SecuriteInfo.com.BackDoor.Generic12.AOUE.3057.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Malware family:

Qakbot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/490cbba7-e427-443f-b9bf-acf7a595e7f5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/98d07ae48bad89ce3395dd0a67deafc5a8dd941b151b03cca0dbdfef033bbf0b/

Threat name:

Win32.Backdoor.Quakbot

Status:

Malicious

First seen:

2021-09-27 17:46:11 UTC

AV detection:

18 of 28 (64.29%)

Threat level:

5/5

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:obama104 campaign:1632729661 banker evasion stealer trojan

Link:

https://tria.ge/reports/210927-wcczvahfa5/

Behaviour

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Qakbot/Qbot

Windows security bypass

Malware Config

C2 Extraction:

95.77.223.148:443
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
109.12.111.14:443
105.198.236.99:443
73.77.87.137:443
41.248.239.221:995
182.176.112.182:443
96.37.113.36:993
75.66.88.33:443
162.244.227.34:443
24.229.150.54:995
216.201.162.158:443
92.59.35.196:2222
196.218.227.241:995
24.139.72.117:443
68.207.102.78:443
72.252.201.69:443
2.188.27.77:443
177.130.82.197:2222
68.204.7.158:443
189.210.115.207:443
181.163.96.53:443
24.55.112.61:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995