MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 05bd9cbf9725884979435d684a7268a75eb05d5916dc85325b0286e9ed71a038. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 05bd9cbf9725884979435d684a7268a75eb05d5916dc85325b0286e9ed71a038
SHA3-384 hash: 3181e8af14b291ad3df0b29ce7b5f52865ce8bc09ad9ad79add80fa5968e596a6b2e05c6712bb1a9fa905b9a6a53b39d
SHA1 hash: 6e7b7faee6212f233373c559f0e8900f80b7098a
MD5 hash: e2ea31f06e36a66fe29fdad302410e36
humanhash: uranus-wisconsin-nebraska-delta
File name:44467.7730002314.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:768'512 bytes
First seen:2021-09-28 15:47:26 UTC
Last seen:2021-09-28 17:08:05 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 57775f1d5f7cb33885211ff521ef0102 (3 x Quakbot)
ssdeep 12288:cV75XRqXnVyGXpI7KFHpsqJtjA42je3kyS6wEB35cKC:/XnVyyDWIkBy3kySqBpd
Threatray 176 similar samples on MalwareBazaar
TLSH T1BEF42A007A54E414F6B91A758E6EE1E8061C7E449FB4A0CF79D03F8F6A3A9E29931307
Reporter Casperinous
Tags:dll Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/192668/
Detection(s):
SecuriteInfo.com.W32.Qbot.FY.genEldorado.29597.1299.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/34be1c34-6522-450c-9b61-30bb88eb5133
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/860009
Signature
Allocates memory in foreign processes
Found malware configuration
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Regsvr32 Command Line Without DLL
Sigma detected: Schedule system process
Uses cmd line tools excessively to alter registry or file data
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 492448 Sample: 44467.7730002314.dat Startdate: 28/09/2021 Architecture: WINDOWS Score: 96 70 Found malware configuration 2->70 72 Yara detected Qbot 2->72 74 Sigma detected: Schedule system process 2->74 76 Sigma detected: Regsvr32 Command Line Without DLL 2->76 10 loaddll32.exe 1 2->10         started        13 regsvr32.exe 2->13         started        15 regsvr32.exe 2->15         started        process3 signatures4 78 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->78 80 Injects code into the Windows Explorer (explorer.exe) 10->80 82 Writes to foreign memory regions 10->82 84 2 other signatures 10->84 17 rundll32.exe 10->17         started        20 cmd.exe 1 10->20         started        22 rundll32.exe 10->22         started        28 2 other processes 10->28 24 regsvr32.exe 13->24         started        26 regsvr32.exe 15->26         started        process5 signatures6 60 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 17->60 62 Injects code into the Windows Explorer (explorer.exe) 17->62 64 Writes to foreign memory regions 17->64 30 explorer.exe 17->30         started        33 rundll32.exe 20->33         started        35 explorer.exe 22->35         started        66 Allocates memory in foreign processes 24->66 68 Maps a DLL or memory area into another process 24->68 37 explorer.exe 8 2 24->37         started        40 explorer.exe 28->40         started        process7 file8 86 Uses schtasks.exe or at.exe to add and modify task schedules 30->86 88 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 33->88 90 Injects code into the Windows Explorer (explorer.exe) 33->90 92 Writes to foreign memory regions 33->92 96 2 other signatures 33->96 42 explorer.exe 8 1 33->42         started        58 C:\Users\user\Desktop\44467.7730002314.dll, PE32 37->58 dropped 94 Uses cmd line tools excessively to alter registry or file data 37->94 44 reg.exe 1 1 37->44         started        46 reg.exe 1 1 37->46         started        48 conhost.exe 37->48         started        signatures9 process10 process11 50 schtasks.exe 1 42->50         started        52 conhost.exe 44->52         started        54 conhost.exe 46->54         started        process12 56 conhost.exe 50->56         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/05bd9cbf9725884979435d684a7268a75eb05d5916dc85325b0286e9ed71a038/
Threat name:
Win32.Infostealer.QBot
Create hunting rule
Status:
Malicious
First seen:
2021-09-28 17:08:32 UTC
AV detection:
4 of 45 (8.89%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
gozi
Create hunting rule
Similar samples:
125c904126d0e8449f95059bb3ef990cb8b663510813c4a1562ac11dfd27f993
Quakbot
336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da
Quakbot
61708b724df2980885240bd0cf2cb00b11bd76cd5a9807d0957049c65e871616
Quakbot
66d5d812bb2da8c63173be8c9c0145467953fab91d6d586ef7f3f9e6fa162ef9
Quakbot
6b7ce26148fe55df48e887c1d18fa2c1bb12fa7d85d014dfaf4b801e345fd2cc
Quakbot
7c5a2a1f51bb355baeaac90b5184d4b5e265ae09a5ef34840497ccb1630ad3b2
Quakbot
8d2418d362dfacdb5efdf08a6c3a7f5e8f279670633676333f0466ff8158e5ff
Quakbot
b5bac95d38c0b9a246cf01fd76276870c42bdb38e2c5bab7d47ae04f1c52e969
Quakbot
cf0c686564c106b2da71b916c7d022e77894c6dd48e5dc8fec000254def55f11
Quakbot
cf2652dc2a844f6aa436149211ea57e54102ce3ebd808eded619298c0bb16cc4
Quakbot
+ 166 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama105 campaign:1632821932 banker evasion stealer trojan
Link:
https://tria.ge/reports/210928-s8z8gacdcl/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
120.151.47.189:443
41.228.22.180:443
39.52.241.3:995
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
196.217.156.63:995
120.150.218.241:995
95.77.223.148:443
185.250.148.74:443
181.118.183.94:443
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
76.25.142.196:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
Unpacked files
SH256 hash:
5e3566395c3c569bfb1f16e94d79fdabd987d6fc7acde99930efdf06644c079b
MD5 hash:
0feea9534ea4e3a7c4ac5f9983e2554c
SHA1 hash:
bdd3fb0b9b82735ff1d2f8be2ad119b672c8abb4
Link:
https://www.unpac.me/results/a18c92f9-422b-4405-a162-55dfae60e34e/
SH256 hash:
f50cccc185824ef7b895ea527b796897e02a1ba084ea5ee7c01af8f1fd2e13d0
MD5 hash:
2bdd1c7e9a220b0b42afc5b6328db346
SHA1 hash:
937c8e9c10fa82858a48a571cd3396037cd5bce3
Link:
https://www.unpac.me/results/a18c92f9-422b-4405-a162-55dfae60e34e/
SH256 hash:
05bd9cbf9725884979435d684a7268a75eb05d5916dc85325b0286e9ed71a038
MD5 hash:
e2ea31f06e36a66fe29fdad302410e36
SHA1 hash:
6e7b7faee6212f233373c559f0e8900f80b7098a
Link:
https://www.unpac.me/results/a18c92f9-422b-4405-a162-55dfae60e34e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/05bd9cbf9725884979435d684a7268a75eb05d5916dc85325b0286e9ed71a038

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/192668/

Comments