MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 125c904126d0e8449f95059bb3ef990cb8b663510813c4a1562ac11dfd27f993. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 125c904126d0e8449f95059bb3ef990cb8b663510813c4a1562ac11dfd27f993
SHA3-384 hash: d60cb22b12cae129c42a52c6b563a3a10661e30d63fc4c599e7f65077798dd6ad6b0a17fa99455c526afa45851e889b4
SHA1 hash: 13581c6f4c6fdf479d62355b2562a35f1d04d8f5
MD5 hash: c4ba51478e36d0e047d5047abf9df1b6
humanhash: sierra-high-fanta-bacon
File name:44466.7417266204.dat.Drezd.red.dll
Download: download sample
Signature Quakbot
Create hunting rule
File size:387'072 bytes
First seen:2021-09-27 15:56:41 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash ef258cd2a69e4871222e8a6651dd9af8 (8 x Quakbot)
ssdeep 3072:Do6vBnby4Yx0XjFFzPQ0MslzERfQB24hLxBVi/b/9+PdpiWC35ol/uwfTuT2b2Mu:vs6Xpq0H3Jhds/9+qC/zfTPLk
Threatray 162 similar samples on MalwareBazaar
TLSH T100846E27B7CEC812FB771FBFB2838A1455F2AD932123512E15E0B614F976A702992770
Reporter info_sec_ca
Tags:dll Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
127
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/192190/
Detection(s):
SecuriteInfo.com.BackDoor.Generic12.AOUE.3057.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching the default Windows debugger (dwwin.exe)
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1d01ccf4-a26b-4c61-8472-3a71694a00a6
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/859144
Signature
Allocates memory in foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
PE file has nameless sections
Sigma detected: Execute DLL with spoofed extension
Sigma detected: Regsvr32 Command Line Without DLL
Sigma detected: Schedule system process
Uses cmd line tools excessively to alter registry or file data
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 491576 Sample: 44466.7417266204.dat.Drezd.... Startdate: 27/09/2021 Architecture: WINDOWS Score: 96 69 Sigma detected: Execute DLL with spoofed extension 2->69 71 Sigma detected: Schedule system process 2->71 73 Machine Learning detection for sample 2->73 75 2 other signatures 2->75 9 loaddll32.exe 1 2->9         started        12 regsvr32.exe 2->12         started        14 regsvr32.exe 2->14         started        process3 signatures4 77 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 9->77 79 Injects code into the Windows Explorer (explorer.exe) 9->79 81 Maps a DLL or memory area into another process 9->81 16 rundll32.exe 9->16         started        19 cmd.exe 1 9->19         started        21 rundll32.exe 9->21         started        23 explorer.exe 8 1 9->23         started        25 regsvr32.exe 12->25         started        27 regsvr32.exe 14->27         started        process5 signatures6 59 Allocates memory in foreign processes 16->59 61 Maps a DLL or memory area into another process 16->61 29 explorer.exe 16->29         started        32 rundll32.exe 19->32         started        34 explorer.exe 21->34         started        36 schtasks.exe 1 23->36         started        63 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 25->63 65 Injects code into the Windows Explorer (explorer.exe) 25->65 67 Writes to foreign memory regions 25->67 38 explorer.exe 8 2 25->38         started        41 WerFault.exe 9 27->41         started        process7 file8 83 Uses schtasks.exe or at.exe to add and modify task schedules 29->83 85 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 32->85 87 Injects code into the Windows Explorer (explorer.exe) 32->87 89 Writes to foreign memory regions 32->89 93 2 other signatures 32->93 43 explorer.exe 32->43         started        45 conhost.exe 36->45         started        57 C:\...\44466.7417266204.dat.Drezd.red.dll, PE32 38->57 dropped 91 Uses cmd line tools excessively to alter registry or file data 38->91 47 reg.exe 1 1 38->47         started        49 reg.exe 1 1 38->49         started        51 conhost.exe 38->51         started        signatures9 process10 process11 53 conhost.exe 47->53         started        55 conhost.exe 49->55         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/125c904126d0e8449f95059bb3ef990cb8b663510813c4a1562ac11dfd27f993/
Threat name:
Win32.Infostealer.QBot
Create hunting rule
Status:
Malicious
First seen:
2021-09-27 15:57:08 UTC
AV detection:
15 of 45 (33.33%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
2915591ef479332f179e26a3f6e4a63c35049569f5ca42d067f64dbdae681df9
Quakbot
2c84012e233c6b20375f1f0712f615154709d40df1847879ed5758bc5b0d339d
Quakbot
2dca3e9494cc2b34e8e1d53d1c9b78830ef35cda9473c5a0b8d84ef9bf4ea330
Quakbot
336cdd146beca939c6d1e3e3c00cc10ec2d6e859a18d350bff937ad5194c27da
Quakbot
45e5bddd31db89802853edbb213d2b1bbd9837fc0a2c2fafc44293633726566b
Quakbot
507b876c0338193836078c588a6d0085ab63fe65848bbead2bdfb0391f615d3f
Quakbot
6b7ce26148fe55df48e887c1d18fa2c1bb12fa7d85d014dfaf4b801e345fd2cc
Quakbot
8d55a54993c00a00daccdf2c7bf69978dbc0222af5b2d024e4e2043695401040
Quakbot
901c1e9a4daf9000c13a6a17acfe5c4e703b8ecf505cf8681aaffd0fa2efe593
Quakbot
dd333db4f622d57ab029da1159bc4e803647429e942e48e437829009c83f79af
Quakbot
+ 152 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama104 campaign:1632729661 banker evasion stealer trojan
Link:
https://tria.ge/reports/210927-tdya3ahdd8/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
95.77.223.148:443
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
109.12.111.14:443
105.198.236.99:443
73.77.87.137:443
41.248.239.221:995
182.176.112.182:443
96.37.113.36:993
75.66.88.33:443
162.244.227.34:443
24.229.150.54:995
216.201.162.158:443
92.59.35.196:2222
196.218.227.241:995
24.139.72.117:443
68.207.102.78:443
72.252.201.69:443
2.188.27.77:443
177.130.82.197:2222
68.204.7.158:443
189.210.115.207:443
181.163.96.53:443
24.55.112.61:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995
Unpacked files
SH256 hash:
805ff047d6310793ea09552ed31bbc0d58e0940122cbcb8925f311114e16c244
MD5 hash:
132232de2d82f95b73fcf22f8421e48c
SHA1 hash:
949b03c6635c641e55869cb752cbca9db6bc115c
Link:
https://www.unpac.me/results/72d8f3e5-a8ed-4dc2-9943-8d13ab45105d/
SH256 hash:
125c904126d0e8449f95059bb3ef990cb8b663510813c4a1562ac11dfd27f993
MD5 hash:
c4ba51478e36d0e047d5047abf9df1b6
SHA1 hash:
13581c6f4c6fdf479d62355b2562a35f1d04d8f5
Link:
https://www.unpac.me/results/72d8f3e5-a8ed-4dc2-9943-8d13ab45105d/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/125c904126d0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/125c904126d0e8449f95059bb3ef990cb8b663510813c4a1562ac11dfd27f993

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/192190/

Comments