MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cdad75e7830e4ae946bb26c15be354676820710c2471d9ea6d24926fc0df86f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1cdad75e7830e4ae946bb26c15be354676820710c2471d9ea6d24926fc0df86f
SHA3-384 hash: 888b2d9d1b0a15c1271d572b0e063a203e75102510ffb42c10c84677419dfce619933f45d86b9a5246aa48950510353a
SHA1 hash: 38eacb884c084f9e455e6e32002661a95bb7e4f5
MD5 hash: 0fa38d62e10a8aae27e6624c29e94dc0
humanhash: fourteen-wolfram-uncle-louisiana
File name:0fa38d62e10a8aae27e6624c29e94dc0
Download: download sample
Signature Quakbot
Create hunting rule
File size:1'246'091 bytes
First seen:2022-04-07 16:18:21 UTC
Last seen:2022-04-07 16:53:19 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash f81bb82289ec73914a479a84abe90d22 (3 x Quakbot)
ssdeep 24576:WGSMYc5q4x3VBjY6dz0DUt39ZZzefHNQRWxT96L8aEUn5AefEdYSlPB5zRf+ev5m:a
Threatray 429 similar samples on MalwareBazaar
TLSH T1F945AFB876047DDAE56F427BDE96ACDD13B6273289CB94CD8065B7C30963372EE02805
Reporter pr0xylife
Tags:AA dll Qakbot Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
259
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/261760/
Detection(s):
SecuriteInfo.com.FileRepMalwareMisc.9624.20587.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Creating a window
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
overlay
Link:
https://www.filescan.io/uploads/624f0efabbd90911a2908a3b/reports/92af2e56-f54e-4d7b-9080-0fbb2c18b478/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/ebdf3c8a-67d2-44a1-a5fe-e647d505e0e2
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/972558
Signature
Allocates memory in foreign processes
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Suspicious Call by Ordinal
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 605045 Sample: IH3kyb0hPI.dll Startdate: 07/04/2022 Architecture: WINDOWS Score: 76 35 Multi AV Scanner detection for submitted file 2->35 37 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->37 39 Sigma detected: Suspicious Call by Ordinal 2->39 8 loaddll32.exe 1 2->8         started        process3 signatures4 41 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->41 43 Injects code into the Windows Explorer (explorer.exe) 8->43 45 Writes to foreign memory regions 8->45 47 2 other signatures 8->47 11 regsvr32.exe 8->11         started        14 cmd.exe 1 8->14         started        16 rundll32.exe 8->16         started        18 3 other processes 8->18 process5 signatures6 49 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 11->49 51 Injects code into the Windows Explorer (explorer.exe) 11->51 53 Writes to foreign memory regions 11->53 55 2 other signatures 11->55 20 explorer.exe 8 1 11->20         started        22 rundll32.exe 14->22         started        24 WerFault.exe 9 16->24         started        27 WerFault.exe 23 9 18->27         started        29 WerFault.exe 9 18->29         started        process7 dnsIp8 31 WerFault.exe 2 9 22->31         started        33 192.168.2.1 unknown unknown 24->33 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1cdad75e7830e4ae946bb26c15be354676820710c2471d9ea6d24926fc0df86f/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-04-07 16:19:09 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
0924d35df6c4c9d97df5da3bfd8ecf136979eaf9eef13e082a6337af5549d6e0
Quakbot
0ff53bc0243122381aa964067287c6128d75a565955f1e0a2f0f82b46428963d
Quakbot
60d4424bf0e6f70e66571a1d038780b9d8e91cb03e58dbec4de002619c1c12d8
Quakbot
73f5c306c33c980fcd85f185af9c2a2b7678eebda5b10ec072558bd74dd776af
Quakbot
89a1fc475c266fe386fa517eb51d7c00bcd4b0262bba095d468c5f4da51f312c
Quakbot
934cb585f33fe11bcd0e99f4df40de07eec50aae0c6d036527fc03fe6d7d0fc8
Quakbot
dc9e4fb434d9be18748858c4daa2744931a60c645ec913b76719b19e634ce665
Quakbot
eb14763a3242cfc46ea26a42f68dec0f08488b12adb9590aebd142844de903a4
Quakbot
+ 419 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220407-tsg8dsfefk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
1cdad75e7830e4ae946bb26c15be354676820710c2471d9ea6d24926fc0df86f
MD5 hash:
0fa38d62e10a8aae27e6624c29e94dc0
SHA1 hash:
38eacb884c084f9e455e6e32002661a95bb7e4f5
Link:
https://www.unpac.me/results/deb7bc32-55a1-46f9-afae-94bbeca1fee5/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/1cdad75e7830/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1cdad75e7830e4ae946bb26c15be354676820710c2471d9ea6d24926fc0df86f

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/261760/

Comments