MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248
SHA3-384 hash: e23539b38d40f8eeca0bdb888d8e70135c82a61a46c958f00228113274fdb032c2fef10dc687a439132f08bf183ea5d9
SHA1 hash: c0d6be6324a341c26cc36ccddf663e95104d05fc
MD5 hash: 82ec0e1df076c986704fe0f919d6a53f
humanhash: alanine-arizona-quebec-wisconsin
File name:Celod.wac1
Download: download sample
Signature Quakbot
Create hunting rule
File size:585'728 bytes
First seen:2021-10-13 15:35:43 UTC
Last seen:2021-10-13 17:08:35 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 9a30e75c82eff20dfe0e0897d34cb07c (4 x Quakbot)
ssdeep 6144:VJVAfqX+2Rr+nxQDBO03fHEera3bpt5eHd:VvAfLfaEkAz5e
Threatray 289 similar samples on MalwareBazaar
TLSH T11CC409A5AD0D8C73FDD42A3052836E082E1B7FD2B17C318F316BF6146D6BB94A891E14
Reporter ffforward
Tags:dll obama obama114 Qakbot qbot Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
331
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/197281/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.4011.25317.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.ArtemisAA054899F7CA.20729.9284.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Link:
https://www.filescan.io/uploads/6166fce79fb4d8593d63c202/reports/ac3dffa1-c40d-4123-babc-79b6d5e44918/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/8a46dbd6-ec86-4a4d-ba58-d58902800a7a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248/
Threat name:
Win32.Infostealer.QBot
Create hunting rule
Status:
Malicious
First seen:
2021-10-13 15:41:10 UTC
AV detection:
14 of 40 (35.00%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
0febefd671c4bdf38e3fad477e1b51b3a6186b3de0daf20bf83a17f058b17b61
Quakbot
3c07a7129dcc798b6d50a38c83ddab99c77d039be3aabea196c34c4ac037d4fc
Quakbot
3c76bd8fd68f63f63680669b0e98ecf46fc48d023783646cdc7f38e69bc826f3
Quakbot
41dd0bd719d55ba7aad212f014ab9ca3f53451d2764a4d2131ca4b56cd7e89bc
Quakbot
ab523acae165286b7dbc6819412eb8ec0ceb3918a279a7beef38a698eb47bbf3
Quakbot
b17fcba15d1b9367a3d8d48a646c2688a0e07e936d5e3f0ac69559db3abbc57e
Quakbot
d9f63db8dc54b130b088b21c4c6733dbe9c44bb82211627834972be16e63449a
Quakbot
eb07ade8a791a70f5bb93fb686ceda74c5c229780837764dd343102b9fce7535
Quakbot
efebf5d864b6840e519d1a02d4fa84fe97f2a4e576d03442b9fdb0c57afa19b8
Quakbot
f0c66d605df8bf0f91c36f968dac5f9b825ef98128f4133ceab5508a89b60d56
Quakbot
+ 279 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama114 campaign:1634112211 banker evasion stealer trojan
Link:
https://tria.ge/reports/211013-s1x35secfm/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
111.125.245.116:443
124.123.42.115:2222
103.250.38.115:443
68.117.229.117:443
189.252.166.130:32101
89.137.52.44:443
208.78.220.143:443
77.31.162.93:443
83.110.201.195:443
94.200.181.154:443
103.82.211.39:995
216.201.162.158:443
78.179.137.102:995
24.231.209.2:2222
63.143.92.99:995
140.82.49.12:443
73.230.205.91:443
41.86.42.158:995
220.255.25.28:2222
200.232.214.222:995
78.105.213.151:995
65.100.174.110:32103
75.131.217.182:443
65.100.174.110:443
41.228.22.180:443
136.232.254.46:995
66.177.215.152:0
120.150.218.241:995
27.223.92.142:995
174.54.193.186:443
81.241.252.59:2078
117.198.151.182:443
73.52.50.32:443
89.101.97.139:443
81.250.153.227:2222
146.66.238.74:443
167.248.117.81:443
136.232.34.70:443
67.230.44.194:443
181.118.183.94:443
65.100.174.110:8443
103.82.211.39:993
98.203.26.168:443
69.30.186.190:443
199.27.127.129:443
93.48.58.123:2222
193.17.190.124:995
24.119.214.7:443
115.96.62.113:443
72.173.78.211:443
129.35.116.77:990
185.250.148.74:443
103.142.10.177:443
197.89.11.159:443
103.148.120.144:443
76.25.142.196:443
82.178.55.68:443
173.22.178.66:443
173.21.10.71:2222
37.210.152.224:995
189.135.16.92:443
187.149.255.245:443
67.165.206.193:993
71.74.12.34:443
75.188.35.168:443
73.151.236.31:443
189.146.41.71:443
72.252.32.47:443
187.156.128.153:443
68.204.7.158:443
47.40.196.233:2222
72.252.201.69:995
24.55.112.61:443
109.12.111.14:443
181.4.53.6:465
24.139.72.117:443
24.229.150.54:995
50.194.160.233:995
189.147.159.42:443
45.46.53.140:2222
24.231.209.2:8443
105.242.94.246:995
24.231.209.2:50000
24.231.209.2:1194
24.107.165.50:443
50.194.160.233:993
37.117.191.19:2222
50.194.160.233:22
24.231.209.2:2083
24.231.209.2:2087
2.222.167.138:443
24.231.209.2:2078
24.231.209.2:6881
39.49.64.244:995
24.231.209.2:50001
24.231.209.2:32100
50.194.160.233:443
123.201.40.112:443
120.151.47.189:443
86.152.43.223:443
67.166.233.75:443
122.11.222.242:2222
187.250.159.104:443
75.66.88.33:443
201.68.60.118:995
188.55.245.223:995
73.77.87.137:443
66.216.193.114:443
96.57.188.174:2078
81.213.59.22:443
73.207.119.14:443
105.198.236.99:443
182.181.67.141:995
68.117.61.91:2222
80.6.192.58:443
109.177.115.85:995
41.86.42.158:443
197.90.242.92:61201
121.52.154.80:995
186.32.163.199:443
203.213.107.174:443
73.77.87.137:995
86.8.177.143:443
209.50.20.255:443
72.27.211.245:995
77.57.204.78:443
99.227.243.24:993
187.172.230.218:443
189.54.223.244:995
47.22.148.6:443
98.157.235.126:443
2.99.100.134:2222
182.176.180.73:443
40.131.140.155:995
162.244.227.34:443
110.174.64.179:995
202.134.178.157:443
189.136.217.97:995
66.103.170.104:2222
172.84.165.118:995
Unpacked files
SH256 hash:
98a20886c99023bde8bf7e627694dfe2170b5a7e7ea70cd3452a698fbb2a9209
MD5 hash:
530664194545f3e1645ea6fe8fa60cdf
SHA1 hash:
6085520e93686fd095b9d64b82fb61b8bd97ecc6
Link:
https://www.unpac.me/results/4c6e02cb-9a85-4734-902e-d5635958a653/
SH256 hash:
27e40e99ccb2306a239f9af914f7f0573b7ab17444016d2c3f615dd84e3507ff
MD5 hash:
2d1cb2ed67816988a5483497161924f5
SHA1 hash:
d6a410c47ca859627916053b53ccb68c1e6a4345
Link:
https://www.unpac.me/results/4c6e02cb-9a85-4734-902e-d5635958a653/
SH256 hash:
ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248
MD5 hash:
82ec0e1df076c986704fe0f919d6a53f
SHA1 hash:
c0d6be6324a341c26cc36ccddf663e95104d05fc
Link:
https://www.unpac.me/results/4c6e02cb-9a85-4734-902e-d5635958a653/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/ae9f663e051b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

DLL dll ae9f663e051bccb9f24f0dd77eb714b2b6baf572993343d7bcd3f74cfcca5248

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/197281/

Comments