MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03f3b96850249c01f6eb4bedf27f9a1835f56d258b19146c0486b4b42d0c5687. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments 1

SHA256 hash:	03f3b96850249c01f6eb4bedf27f9a1835f56d258b19146c0486b4b42d0c5687
SHA3-384 hash:	05810130b51be9d06db2336c7c4eb2f658cd82d73aa3b2cc598325a48c01e11f35d00933f35309179cba0f86e8114fdb
SHA1 hash:	05abf51dab97a4c4f1005fafb607660e5c3bded4
MD5 hash:	c4106953c58e3ee2540b66fe72e1be85
humanhash:	six-purple-illinois-king
File name:	c4106953c58e3ee2540b66fe72e1be85
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	800'768 bytes
First seen:	2021-05-01 14:51:42 UTC
Last seen:	2021-05-01 15:57:23 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	826b8583e9b3c846c8b3c651780f2bd2 (2 x Quakbot)
ssdeep	12288:l50YpKf2i/wNB+hu8BF2Vk3No+xq7pZ/3F8tTdxcb/7Ry251RvZcCELcmRB3:l50cKr4LoxRyUCZx51RvGb4mRB
Threatray	1'363 similar samples on MalwareBazaar
TLSH	6905AD707153C136D2726E35CD0AE5FD1A817C1AEF2A180B36D23FAFBB351614A36269
Reporter	malwarelabnet
Tags:	Qakbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

307

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/147865/

Detection(s):

SecuriteInfo.com.Variant.Zusy.380250.1430.23252.UNOFFICIAL

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Sending a UDP request

Launching a process

Creating a process with a hidden window

Creating a window

Unauthorized injection to a system process

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

qbot

Link:

https://mwdb.cert.pl/sample/03f3b96850249c01f6eb4bedf27f9a1835f56d258b19146c0486b4b42d0c5687/

Threat name:

Win32.Trojan.Zusy

Status:

Malicious

First seen:

2021-05-01 14:52:10 UTC

AV detection:

14 of 47 (29.79%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=apz3s2cqesoad5xljpw7e742da27k3jfrmmri3aeq22lilimk2dq._file

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/210501-3kpy95ezrx/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Unpacked files

SH256 hash:

3aba9b9d8afd387fd1197fbed5e1cea356ef65e72c13e4c0af1d601799a91d26

MD5 hash:

73b9d663bee50d5d0d5f1a5d2b4538d8

SHA1 hash:

dbf7e5ee4269f82074a2b8052587eadb1b3ae599

Detections:

win_qakbot_auto

Link:

https://www.unpac.me/results/0368ad58-4ab6-437c-b2b0-5ee57ac10dc9/

SH256 hash:

03f3b96850249c01f6eb4bedf27f9a1835f56d258b19146c0486b4b42d0c5687

MD5 hash:

c4106953c58e3ee2540b66fe72e1be85

SHA1 hash:

05abf51dab97a4c4f1005fafb607660e5c3bded4

Link:

https://www.unpac.me/results/0368ad58-4ab6-437c-b2b0-5ee57ac10dc9/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/03f3b96850249c01f6eb4bedf27f9a1835f56d258b19146c0486b4b42d0c5687

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QakBot Create hunting rule
Author:	kevoreilly
Description:	QakBot Payload

Rule name:	win_qakbot_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/147865/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-01 15:14:03 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0052] File System Micro-objective::Writes File
1) [C0034.001] Operating System Micro-objective::Set Variable::Environment Variable
2) [C0040] Process Micro-objective::Allocate Thread Local Storage
3) [C0041] Process Micro-objective::Set Thread Local Storage Value
4) [C0018] Process Micro-objective::Terminate Process