MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24a61ae809abf33396ed1e80315c7fd6a317adff261bff0994acb61d442ccb42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 24a61ae809abf33396ed1e80315c7fd6a317adff261bff0994acb61d442ccb42
SHA3-384 hash: 05fd617d4caf2c11c58ac567519f73f03322f9bd98babcee18982cda28b0b00469ba3a697bf6fa449c58a705765496fb
SHA1 hash: 866bb9672b234dbdb025c672f372c3714636897e
MD5 hash: a7be720bdb7a5feafbb77447fc49586b
humanhash: batman-carolina-crazy-king
File name:104158286890.dat.dll
Download: download sample
Signature Quakbot
Create hunting rule
File size:826'880 bytes
First seen:2021-12-01 16:37:19 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dd67101cfae85d6dccab2ea3988714da (5 x Quakbot)
ssdeep 12288:1o7uuAIEsufrP3FwsmlBdiwW/jJc61gOHtJQ8DgrCrhxEmLl3JQ8DgrCrhxEmLlq:83Lxu73FPv/uGDZgryhxEm/ZgryhxEm
Threatray 406 similar samples on MalwareBazaar
TLSH T11405B022F2A04833D1732A7D9C17527C592A7E512D389C4A2BD81F8C7FB96913F2725B
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter James_inthe_box
Tags:dll Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/210379/
Detection(s):
Win.Malware.Zusy-9910308-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching a process
Modifying an executable file
Creating a process with a hidden window
DNS request
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
keylogger zusy
Link:
https://www.filescan.io/uploads/61a7a4ee86bf67e7121db03f/reports/6a8df9c4-9ed3-46c9-b259-0179a1665cd5/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/82f9ef29-abb2-4bac-91a7-63980ed2e1af
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/899593
Signature
Allocates memory in foreign processes
Contains functionality to detect sleep reduction / modifications
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Execute DLL with spoofed extension
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/24a61ae809abf33396ed1e80315c7fd6a317adff261bff0994acb61d442ccb42/
Threat name:
Win32.Trojan.Bunitucrypt
Create hunting rule
Status:
Malicious
First seen:
2021-12-01 16:37:08 UTC
File Type:
PE (Dll)
Extracted files:
40
AV detection:
23 of 27 (85.19%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=estbv2ajvpzthfxnd2adcxd722rrplp7eyn76cmuvs3b2rbmznba._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
1f29904e403ca1fb412c1e0901e1c2c386c9be53149c793c1aca1bf5835ace85
Quakbot
268cf4bdbb872b24825068cc75677e51941b67003a7a589963715808e9f4728a
Quakbot
3cde8a896848e9c28ccfcc2db7812602143de7be90aa44fcfe83c85ac7e53f9b
Quakbot
3d49f30ed4cef3d532cbc73d99560d7c81db4928e8e2e81d2c83ef09196f17c1
Quakbot
78b55c9b294bdbc2642cd2d9377ab54ac80596fc680e35111d9496409e88080a
Quakbot
a2a676d3c97975edce1e09d9f777287bc953b382962005030f7627d6da08b00a
Quakbot
c053795483b5ddb0176a84998a8907fa1997af0e0376275ebf34655f10b174e7
Quakbot
+ 396 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama139 campaign:1638350683 banker evasion stealer trojan
Link:
https://tria.ge/reports/211201-t5em2adhcr/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
190.73.3.148:2222
39.49.13.81:995
105.198.236.99:995
136.143.11.232:443
2.222.167.138:443
197.89.11.160:443
117.248.109.38:21
174.20.72.123:443
140.82.49.12:443
78.180.170.159:995
103.142.10.177:443
120.150.218.241:995
91.178.126.51:995
81.250.153.227:2222
194.36.28.26:443
89.101.97.139:443
117.198.158.34:443
189.252.184.31:32101
38.70.253.226:2222
93.48.80.198:995
71.74.12.34:443
207.246.112.221:443
216.238.71.31:443
207.246.112.221:995
186.64.67.31:443
136.232.34.70:443
218.101.110.3:995
76.25.142.196:443
102.65.38.57:443
173.21.10.71:2222
94.60.254.81:443
45.46.53.140:2222
189.135.34.124:443
73.151.236.31:443
67.165.206.193:993
200.114.247.160:465
68.204.7.158:443
189.147.174.121:443
100.1.119.41:443
189.152.1.74:80
50.194.160.233:32100
174.206.64.101:443
50.194.160.233:443
24.229.150.54:995
109.12.111.14:443
217.17.56.163:2222
24.55.112.61:443
24.139.72.117:443
182.181.86.190:995
75.169.58.229:32100
129.208.154.145:995
217.165.237.42:443
89.137.52.44:443
73.25.109.183:2222
185.53.147.51:443
103.116.178.85:993
86.8.177.143:443
86.97.10.14:443
27.5.4.111:2222
80.6.192.58:443
101.50.103.248:995
65.100.174.110:8443
94.200.181.154:995
65.100.174.110:995
63.143.92.99:995
75.188.35.168:995
182.176.180.73:443
75.66.88.33:443
189.219.48.188:443
94.203.203.3:995
86.120.85.147:443
123.252.190.14:443
103.150.40.76:995
41.228.22.180:443
111.250.17.237:443
73.140.38.124:443
176.63.117.1:22
111.91.87.187:443
220.255.25.187:2222
92.59.35.196:2222
72.252.201.34:465
209.210.95.228:443
68.186.192.69:443
187.121.105.111:995
103.168.241.143:995
103.168.241.143:465
86.190.203.103:443
93.147.212.206:443
5.238.149.217:61202
72.252.201.34:995
24.152.219.253:995
96.37.113.36:993
45.9.20.200:2211
103.116.178.85:61200
93.48.58.123:2222
27.223.92.142:995
Unpacked files
SH256 hash:
a0c1d378dc368e0ebad8d2f65747bf0493e9fe7ddfe3177ed7e638d9d32f0a59
MD5 hash:
266abbd3c1330a50c2ff1a04e0796167
SHA1 hash:
953132d9ef6f3900541693183047523baf3e6932
Link:
https://www.unpac.me/results/84a86640-a284-4026-a540-edd6cc2aab19/
SH256 hash:
4ed482a48055f3215202887fb288c7f2a1649de2353bf6c544e2320f5d9d81c9
MD5 hash:
62bfe46442886a4697ff77bb4d194676
SHA1 hash:
c21bab57383757aced56441ab64b4ab06a6eca80
Link:
https://www.unpac.me/results/84a86640-a284-4026-a540-edd6cc2aab19/
SH256 hash:
24a61ae809abf33396ed1e80315c7fd6a317adff261bff0994acb61d442ccb42
MD5 hash:
a7be720bdb7a5feafbb77447fc49586b
SHA1 hash:
866bb9672b234dbdb025c672f372c3714636897e
Link:
https://www.unpac.me/results/84a86640-a284-4026-a540-edd6cc2aab19/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/24a61ae809ab/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/24a61ae809abf33396ed1e80315c7fd6a317adff261bff0994acb61d442ccb42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/210379/

Comments