MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 047ca8140f4309e1168a26de0fc04ab07d3ecae155c9c70c3cfa8bf7cdc1471e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 047ca8140f4309e1168a26de0fc04ab07d3ecae155c9c70c3cfa8bf7cdc1471e
SHA3-384 hash: 4ced2c237e1266ed1c067284f620549827b2994a33be3e61182e06e3131c3c8751385e29754349dea3ac0cf6efa3b80d
SHA1 hash: 0be8e4d452b00aae2c19bced7a6ed9d9dc99b1f2
MD5 hash: 17f776331866aa558d9526edfa8d23a8
humanhash: hydrogen-fruit-enemy-violet
File name:047ca8140f4309e1168a26de0fc04ab07d3ecae155c9c70c3cfa8bf7cdc1471e
Download: download sample
Signature Quakbot
Create hunting rule
File size:345'552 bytes
First seen:2021-02-17 09:35:32 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 86fbdc19e7cee8cd7d94d1a822db2bf6 (21 x Quakbot)
ssdeep 6144:KgOXktvhhOU35RJEesNr3wU7HuAmHKmlEwrPmRPWEpWFn2E6lyD5:ckvhhOKJETRByqTwr03pdf6
Threatray 143 similar samples on MalwareBazaar
TLSH CC747D396A1AD0A2D27C27B183C3EF541E67DAD53234441712B3DE183EB66A4BE35F14
Reporter JAMESWT_WT
Tags:ADV TOURS d.o.o. Quakbot signed

Code Signing Certificate

Organisation:ADV TOURS d.o.o.
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2021-02-11T00:00:00Z
Valid to:2022-02-11T23:59:59Z
Serial number: d3356318924c8c42959bf1d1574e6482
Intelligence: 17 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 962518bfabcda183ed702c09a4ada754bf4da8af8244d7ee57fcf952fd929b8e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117559/
Detection(s):
SecuriteInfo.com.Mal.EncPk-APW.1169.15.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Launching a process
DNS request
Sending a UDP request
Modifying an executable file
Creating a process with a hidden window
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/610076
Signature
Allocates memory in foreign processes
Found malware configuration
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Schedule REGSVR windows binary
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 354061 Sample: YWOro8qqYg Startdate: 17/02/2021 Architecture: WINDOWS Score: 96 42 Found malware configuration 2->42 44 Sigma detected: Schedule REGSVR windows binary 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 2 other signatures 2->48 9 loaddll32.exe 1 2->9         started        11 regsvr32.exe 2->11         started        process3 process4 13 regsvr32.exe 9->13         started        16 cmd.exe 1 9->16         started        18 regsvr32.exe 11->18         started        signatures5 50 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 13->50 52 Injects code into the Windows Explorer (explorer.exe) 13->52 54 Writes to foreign memory regions 13->54 56 2 other signatures 13->56 20 explorer.exe 8 1 13->20         started        23 iexplore.exe 2 83 16->23         started        25 WerFault.exe 20 9 18->25         started        process6 file7 34 C:\Users\user\Desktop\YWOro8qqYg.dll, PE32 20->34 dropped 27 schtasks.exe 1 20->27         started        29 iexplore.exe 5 158 23->29         started        process8 dnsIp9 32 conhost.exe 27->32         started        36 img.img-taboola.com 29->36 38 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49741, 49742 FASTLYUS United States 29->38 40 8 other IPs or domains 29->40 process10
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/047ca8140f4309e1168a26de0fc04ab07d3ecae155c9c70c3cfa8bf7cdc1471e/
Threat name:
Win32.Infostealer.QBot
Create hunting rule
Status:
Malicious
First seen:
2021-02-17 09:35:53 UTC
File Type:
PE (Dll)
AV detection:
15 of 47 (31.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ar6kqfapime6cfuke3pa7qckwb6t5sxbkxe4odb47kf7ptobi4pa._file
Verdict:
malicious
Similar samples:
11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78
Quakbot
1301c04439622d546f5b4f0834155e17db23ccdd57381fd6fca8edf1962660b4
Quakbot
28dc2c996b617a38dea25fdaf5a01af002b3f1832a0c33189cce00b33ea21856
Quakbot
2c5e0ddf6689e055e33b0bf8a9d79abe89095107c81f68c44db02d8809986a12
Quakbot
6d10ae2b310fc8d3b8a2690afb40ff153ffca5f320a08d07c7d8b5a05a9dcd2c
Quakbot
748db1f530fa931a4b0bfa8df7c96f84d3bd8b40591960c9453d19df827c0dd4
Quakbot
89f295e3f67f0d1787dff3c18d74764fb354c09ad6ade10544577dfedc25e83d
Quakbot
8f7a1de9a03d301ac9144fd6620978ccded44aeb05a62425b32cd1c464705da1
Quakbot
a395600eca0288b1a6c84746245439360e1e9a6e7277126ec0777d74dbc2222c
Quakbot
ecbd9a6bc051be5a6473a4a008dd26ab1ab6df44254ce2133421d39a55052ae6
Quakbot
+ 133 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama04 campaign:1613469138 banker stealer trojan
Link:
https://tria.ge/reports/210217-5jhkmprkp2/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Malware Config
C2 Extraction:
50.29.166.232:995
89.137.211.239:995
172.78.30.215:443
193.248.221.184:2222
80.227.5.69:443
216.201.162.158:443
75.67.192.125:443
105.96.8.96:443
77.211.30.202:995
136.232.34.70:443
87.202.87.210:2222
86.245.46.27:2222
90.101.117.122:2222
81.97.154.100:443
47.196.192.184:443
197.161.154.132:443
78.185.59.190:443
202.188.138.162:443
77.27.204.204:995
203.194.110.74:443
95.77.223.148:443
173.184.119.153:995
38.92.225.121:443
81.150.181.168:2222
176.205.222.30:2078
90.65.236.181:2222
78.63.226.32:443
84.72.35.226:443
85.52.72.32:2222
98.173.34.212:995
71.117.132.169:443
172.87.157.235:3389
2.232.253.79:995
176.181.247.197:443
202.184.20.119:443
189.223.234.23:995
45.118.216.157:443
195.12.154.8:443
196.151.252.84:443
108.160.123.244:443
96.57.188.174:2222
47.22.148.6:443
82.127.125.209:990
97.69.160.4:2222
115.133.243.6:443
173.21.10.71:2222
172.115.177.204:2222
105.198.236.99:443
86.236.77.68:2222
105.198.236.101:443
98.121.187.78:443
140.82.49.12:443
217.133.54.140:32100
197.45.110.165:995
24.50.118.93:443
217.165.231.192:2078
59.90.246.200:443
83.110.12.140:2222
119.153.62.76:3389
45.63.107.192:443
149.28.99.97:995
207.246.116.237:8443
45.77.117.108:995
207.246.116.237:2222
45.77.117.108:8443
149.28.98.196:2222
149.28.98.196:443
45.32.211.207:8443
45.32.211.207:443
144.202.38.185:443
45.32.211.207:995
45.32.211.207:2222
149.28.98.196:995
144.202.38.185:2222
149.28.101.90:2222
45.77.115.208:8443
149.28.101.90:443
45.77.115.208:995
207.246.77.75:443
144.202.38.185:995
207.246.77.75:995
45.77.117.108:2222
149.28.101.90:995
207.246.116.237:995
45.77.115.208:443
45.63.107.192:995
207.246.77.75:8443
45.77.117.108:443
207.246.77.75:2222
149.28.101.90:8443
45.77.115.208:2222
207.246.116.237:443
45.63.107.192:2222
27.223.92.142:995
73.25.124.140:2222
193.252.48.200:443
85.132.36.111:2222
45.46.53.140:2222
85.58.200.50:2222
188.25.63.105:443
75.136.26.147:443
94.53.92.42:443
157.131.108.180:443
71.199.192.62:443
144.139.47.206:443
67.6.12.4:443
144.139.166.18:443
47.187.99.96:443
71.197.126.250:443
75.118.1.141:443
65.27.228.247:443
71.74.12.34:443
73.153.211.227:443
187.250.6.217:443
98.240.24.57:443
76.25.142.196:443
199.19.117.131:443
189.149.77.114:443
98.252.118.134:443
47.217.24.69:6881
96.250.60.138:443
201.143.235.13:443
189.211.177.183:995
186.28.55.211:443
50.25.89.74:443
151.205.102.42:443
70.54.25.76:2222
82.12.157.95:995
74.68.144.202:443
189.146.183.105:443
181.48.190.78:443
109.12.111.14:443
82.76.47.211:443
72.252.201.69:443
106.51.85.162:443
89.3.198.238:443
72.240.200.181:2222
195.43.173.70:443
24.229.150.54:995
78.22.58.205:3389
213.60.147.140:443
174.104.31.209:443
2.7.69.217:2222
83.110.103.152:443
78.97.207.104:443
182.48.193.200:443
197.51.82.72:443
74.222.204.82:995
41.39.134.183:443
149.28.99.97:2222
Unpacked files
SH256 hash:
bbfd63584a96d6e8e700eab340c4d2d685c504feee9e1966d8e050905c34c686
MD5 hash:
1705ed295dc007e6aada354df0eab708
SHA1 hash:
e6b64c2b5931432492908eff74514e184197f50b
Link:
https://www.unpac.me/results/22dea635-546d-4c53-89f5-247e4747a95d/
SH256 hash:
047ca8140f4309e1168a26de0fc04ab07d3ecae155c9c70c3cfa8bf7cdc1471e
MD5 hash:
17f776331866aa558d9526edfa8d23a8
SHA1 hash:
0be8e4d452b00aae2c19bced7a6ed9d9dc99b1f2
Link:
https://www.unpac.me/results/22dea635-546d-4c53-89f5-247e4747a95d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/047ca8140f4309e1168a26de0fc04ab07d3ecae155c9c70c3cfa8bf7cdc1471e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:qbot_bin
Create hunting rule
Author:James_inthe_box
Description:Qbot Qakbot
Reference:https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/117559/

Comments