MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ac738b061845ca506d186c7749080cdbf443f859e2b551dd0402474b2604b249. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 3
| SHA256 hash: | ac738b061845ca506d186c7749080cdbf443f859e2b551dd0402474b2604b249 |
|---|---|
| SHA3-384 hash: | 0e3139e2bf098f8050b42670d9516ef8c57f8f8ffb4b599c8d4f8d9939a59624571b67b892c54854e08e99c20b7d9ce4 |
| SHA1 hash: | 49f959f7f1e333b692c9ca0b13f6c714cf134bc8 |
| MD5 hash: | d6db716f1e929bca261656a027ad621a |
| humanhash: | muppet-wisconsin-sodium-stairway |
| File name: | RRBD49.zip |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 309'005 bytes |
| First seen: | 2022-12-07 13:23:57 UTC |
| Last seen: | Never |
| File type: | zip |
| MIME type: | application/zip |
| Note: | This file is a password protected archive. The password is: U12 |
| ssdeep | 6144:WqtzQRLhxB0+zw5VihOHqdpIbdh7QlTIAXEMR93XXGifhhvKf6Grt9a:xiRLhHzw5ViVdQPobR9nX5hZKCGh9a |
| TLSH | T1F1642382EDCB5AD3657ECBD16EA0735E78CC0994A012925A91B785CB1FEF80053FC52C |
| TrID | 80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1) |
| Reporter |  proxylife |
| Tags: | 1670238005 BB09 pw-U12 Qakbot Quakbot zip |
Intelligence
File Origin
# of uploads :
1
# of downloads :
144
Origin country :
RUFile Archive Information
This file is a password protected archive. The password is: U12
This file archive contains 6 file(s), sorted by their relevance:
| File name: | enlisting.cmd |
|---|---|
| File size: | 242 bytes |
| SHA256 hash: | 6fbd6bd17bb83f03e1c1fcf1b4054e55bc1d0a29913c07092c378f6eb7a75042 |
| MD5 hash: | 19d169229401b45456684d6ffb575927 |
| MIME type: | text/plain |
| Signature | Quakbot |
| File name: | disembowels.png |
|---|---|
| File size: | 37'384 bytes |
| SHA256 hash: | fb24ab1d062cfccfda52cbf5ed8dc6a266eb0599b39036083d5fab5acf664ce6 |
| MD5 hash: | e0cf6dbfc1006717e9a848a1c213bbdb |
| MIME type: | image/png |
| Signature | Quakbot |
| File name: | countersink.cmd |
|---|---|
| File size: | 334 bytes |
| SHA256 hash: | 19c18ff61c211c419b5bcacfed5b1f8b0dcf9ea4629f1f42c7c96fe791724342 |
| MD5 hash: | 9d6b53c58320a436a8cba81ed2b36578 |
| MIME type: | text/plain |
| Signature | Quakbot |
| File name: | WPSettings.dat |
|---|---|
| File size: | 12 bytes |
| SHA256 hash: | bbfc0c02a88b753ee4d4d41a31c053e8827ce63e0625a4c6fa8b2cf8b1e6bd0e |
| MD5 hash: | cc1ed1dbebcbc6b92675fa8385c22916 |
| MIME type: | application/octet-stream |
| Signature | Quakbot |
| File name: | fondest.tmp |
|---|---|
| File size: | 508'928 bytes |
| SHA256 hash: | 96d2f4131542e1b4a6e9bba0bf3807008cb8340e7d247b464fdbebe11031d9e2 |
| MD5 hash: | 25f28cb2e56bdbe858e5c82b1fba4d14 |
| MIME type: | application/x-dosexec |
| Signature | Quakbot |
| File name: | RR.lnk |
|---|---|
| File size: | 1'709 bytes |
| SHA256 hash: | 24372ffb6203b0b5baf871d4089a5c2e0a5f7e39bc8681f525c74ab60b52c4a5 |
| MD5 hash: | 99c13f13a9ff15fe23be566df534b00b |
| MIME type: | application/octet-stream |
| Signature | Quakbot |
Vendor Threat Intelligence
Gathering data
Result
Verdict:
UNKNOWN
Link:
Detection(s):
Suspicious file
Result
Malware family:
qakbot
Score:
10/10
Tags:
family:qakbot botnet:bb09 campaign:1670238005 banker stealer trojan
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Qakbot/Qbot
Malware Config
C2 Extraction:
76.100.159.250:443
66.191.69.18:995
186.64.67.9:443
50.90.249.161:443
109.150.179.158:2222
92.149.205.238:2222
86.165.15.180:2222
41.44.19.36:995
78.17.157.5:443
173.18.126.3:443
75.99.125.235:2222
172.90.139.138:2222
27.99.45.237:2222
91.68.227.219:443
12.172.173.82:993
103.144.201.62:2078
12.172.173.82:990
173.239.94.212:443
91.169.12.198:32100
24.64.114.59:2222
74.66.134.24:443
93.164.248.234:443
83.92.85.93:443
78.69.251.252:2222
190.134.138.61:443
2.99.47.198:2222
73.223.248.31:443
12.172.173.82:995
94.63.65.146:443
80.13.179.151:2222
70.120.228.205:2083
216.196.245.102:2078
31.167.254.199:995
89.129.109.27:2222
69.119.123.159:2222
91.254.230.18:443
64.121.161.102:443
38.166.242.12:2087
12.172.173.82:465
75.143.236.149:443
81.229.117.95:2222
74.92.243.113:50000
183.82.100.110:2222
75.98.154.19:443
193.154.202.210:443
121.122.99.223:995
70.115.104.126:995
213.67.255.57:2222
213.91.235.146:443
37.14.229.220:2222
76.80.180.154:995
62.31.130.138:465
89.115.196.99:443
2.83.12.243:443
85.152.152.46:443
188.48.123.229:995
90.104.22.28:2222
201.210.107.223:993
47.41.154.250:443
50.68.204.71:995
84.215.202.22:443
85.241.180.94:443
92.189.214.236:2222
103.55.67.180:443
90.89.95.158:2222
86.217.250.15:2222
72.68.175.55:2222
86.190.16.164:443
136.244.25.165:443
65.30.139.145:995
73.161.176.218:443
199.83.165.233:443
98.145.23.67:443
84.35.26.14:995
24.64.114.59:3389
50.68.204.71:443
102.46.139.82:993
71.247.10.63:995
149.126.159.106:443
58.162.223.233:443
216.196.245.102:2083
184.155.91.69:443
87.99.116.47:443
81.131.210.167:443
103.141.50.117:995
184.176.154.83:995
92.207.132.174:2222
142.161.27.232:2222
176.142.207.63:443
184.153.132.82:443
108.6.249.139:443
69.133.162.35:443
76.20.42.45:443
139.216.164.122:443
24.206.27.39:443
12.172.173.82:21
77.86.98.236:443
50.68.204.71:993
88.126.94.4:50000
85.245.221.87:2078
190.206.70.80:2222
87.221.197.110:2222
83.7.54.186:443
87.223.91.46:443
78.100.230.10:995
181.164.194.228:443
174.101.111.4:443
75.115.14.189:443
86.225.214.138:2222
58.247.115.126:995
86.96.75.237:2222
105.103.56.28:2078
198.2.51.242:993
174.104.184.149:443
105.103.56.28:990
24.64.114.59:61202
93.24.192.142:20
2.14.82.210:2222
90.116.219.167:2222
66.191.69.18:995
186.64.67.9:443
50.90.249.161:443
109.150.179.158:2222
92.149.205.238:2222
86.165.15.180:2222
41.44.19.36:995
78.17.157.5:443
173.18.126.3:443
75.99.125.235:2222
172.90.139.138:2222
27.99.45.237:2222
91.68.227.219:443
12.172.173.82:993
103.144.201.62:2078
12.172.173.82:990
173.239.94.212:443
91.169.12.198:32100
24.64.114.59:2222
74.66.134.24:443
93.164.248.234:443
83.92.85.93:443
78.69.251.252:2222
190.134.138.61:443
2.99.47.198:2222
73.223.248.31:443
12.172.173.82:995
94.63.65.146:443
80.13.179.151:2222
70.120.228.205:2083
216.196.245.102:2078
31.167.254.199:995
89.129.109.27:2222
69.119.123.159:2222
91.254.230.18:443
64.121.161.102:443
38.166.242.12:2087
12.172.173.82:465
75.143.236.149:443
81.229.117.95:2222
74.92.243.113:50000
183.82.100.110:2222
75.98.154.19:443
193.154.202.210:443
121.122.99.223:995
70.115.104.126:995
213.67.255.57:2222
213.91.235.146:443
37.14.229.220:2222
76.80.180.154:995
62.31.130.138:465
89.115.196.99:443
2.83.12.243:443
85.152.152.46:443
188.48.123.229:995
90.104.22.28:2222
201.210.107.223:993
47.41.154.250:443
50.68.204.71:995
84.215.202.22:443
85.241.180.94:443
92.189.214.236:2222
103.55.67.180:443
90.89.95.158:2222
86.217.250.15:2222
72.68.175.55:2222
86.190.16.164:443
136.244.25.165:443
65.30.139.145:995
73.161.176.218:443
199.83.165.233:443
98.145.23.67:443
84.35.26.14:995
24.64.114.59:3389
50.68.204.71:443
102.46.139.82:993
71.247.10.63:995
149.126.159.106:443
58.162.223.233:443
216.196.245.102:2083
184.155.91.69:443
87.99.116.47:443
81.131.210.167:443
103.141.50.117:995
184.176.154.83:995
92.207.132.174:2222
142.161.27.232:2222
176.142.207.63:443
184.153.132.82:443
108.6.249.139:443
69.133.162.35:443
76.20.42.45:443
139.216.164.122:443
24.206.27.39:443
12.172.173.82:21
77.86.98.236:443
50.68.204.71:993
88.126.94.4:50000
85.245.221.87:2078
190.206.70.80:2222
87.221.197.110:2222
83.7.54.186:443
87.223.91.46:443
78.100.230.10:995
181.164.194.228:443
174.101.111.4:443
75.115.14.189:443
86.225.214.138:2222
58.247.115.126:995
86.96.75.237:2222
105.103.56.28:2078
198.2.51.242:993
174.104.184.149:443
105.103.56.28:990
24.64.114.59:61202
93.24.192.142:20
2.14.82.210:2222
90.116.219.167:2222
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | cobalt_strike_tmp01925d3f |
|---|---|
| Author: | The DFIR Report |
| Description: | files - file ~tmp01925d3f.exe |
| Reference: | https://thedfirreport.com |
| Rule name: | PassProtected_ZIP_ISO_file |
|---|---|
| Author: | _jc |
| Description: | Detects container formats commonly smuggled through password-protected zips |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Quakbot
zip ac738b061845ca506d186c7749080cdbf443f859e2b551dd0402474b2604b249
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.