MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 268cf4bdbb872b24825068cc75677e51941b67003a7a589963715808e9f4728a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 12


Intelligence 12 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 268cf4bdbb872b24825068cc75677e51941b67003a7a589963715808e9f4728a
SHA3-384 hash: 67db44f804b60d9e98f12534331974b54da6e440eb86abecce06c9e6a70d72ba5606162431b4fc7aeff3ae3ac9e163b6
SHA1 hash: a31030635e39da1d0e76b93c95e77f14af159c27
MD5 hash: 7a6a3e76b82c91fd849c17ab685b08f0
humanhash: spaghetti-football-jersey-oregon
File name:thn.htm
Download: download sample
Signature Quakbot
Create hunting rule
File size:797'399 bytes
First seen:2021-12-01 13:06:27 UTC
Last seen:2021-12-01 14:41:29 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 891d96fe97f5179317596c2fd766dd91 (1 x Quakbot)
ssdeep 24576:Qscsq3GpzSo5t3nLSZgryhxEhMZgryhxEh:Qtz4L2grMWUgrMW
Threatray 401 similar samples on MalwareBazaar
TLSH T18405B022F2908837D23319385C5B526899397E512D24588927E81FCC7FFA3913FB769B
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter Anonymous
Tags:dll Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
115
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/210313/
Detection(s):
SecuriteInfo.com.Variant.Ulise.326496.15696.24610.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching a process
Modifying an executable file
Creating a process with a hidden window
DNS request
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger overlay
Link:
https://www.filescan.io/uploads/61a7737886bf67e7121d51d8/reports/e8f6110a-4975-44f7-852e-1ff2afe8fa5b/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f48d232e-48fd-4bbe-b700-db10ca058ad0
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/899423
Signature
Allocates memory in foreign processes
Contains functionality to detect sleep reduction / modifications
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 531903 Sample: thn.htm Startdate: 01/12/2021 Architecture: WINDOWS Score: 72 25 Multi AV Scanner detection for submitted file 2->25 8 loaddll32.exe 1 2->8         started        process3 signatures4 27 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->27 29 Injects code into the Windows Explorer (explorer.exe) 8->29 31 Writes to foreign memory regions 8->31 33 3 other signatures 8->33 11 cmd.exe 1 8->11         started        13 explorer.exe 8->13         started        process5 process6 15 rundll32.exe 11->15         started        signatures7 35 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 15->35 37 Injects code into the Windows Explorer (explorer.exe) 15->37 39 Writes to foreign memory regions 15->39 41 3 other signatures 15->41 18 explorer.exe 8 1 15->18         started        21 WerFault.exe 23 9 15->21         started        process8 file9 23 C:\Users\user\Desktop\thn.dll, PE32 18->23 dropped
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/268cf4bdbb872b24825068cc75677e51941b67003a7a589963715808e9f4728a/
Threat name:
Win32.Trojan.Bunitucrypt
Create hunting rule
Status:
Malicious
First seen:
2021-12-01 13:07:15 UTC
File Type:
PE (Dll)
Extracted files:
38
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e2gpjpn3q4vsjasqndghkz36kgkbwzyahj5frgldofmar2puokfa._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
283318a272b4164ad445104b29583a873b16e9d5f8c5976e994f513cd3390fd3
Quakbot
3cde8a896848e9c28ccfcc2db7812602143de7be90aa44fcfe83c85ac7e53f9b
Quakbot
3f7fa2310698749705e4b22ef4e17fcc1e2490b63e803bc9f25d47e0c932e4d0
Quakbot
78b55c9b294bdbc2642cd2d9377ab54ac80596fc680e35111d9496409e88080a
Quakbot
a2a676d3c97975edce1e09d9f777287bc953b382962005030f7627d6da08b00a
Quakbot
c053795483b5ddb0176a84998a8907fa1997af0e0376275ebf34655f10b174e7
Quakbot
+ 391 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:tr campaign:1638169179 banker evasion stealer trojan
Link:
https://tria.ge/reports/211201-qcmw6accdl/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
136.232.34.70:443
117.248.109.38:21
218.101.110.3:995
140.82.49.12:443
102.65.38.57:443
136.143.11.232:443
39.33.188.131:995
76.25.142.196:443
120.150.218.241:995
189.252.156.7:32101
185.53.147.51:443
103.142.10.177:443
117.198.159.148:443
217.165.237.42:443
216.238.71.31:443
207.246.112.221:995
207.246.112.221:443
45.46.53.140:2222
173.21.10.71:2222
67.165.206.193:993
189.135.21.162:443
71.74.12.34:443
86.8.177.143:443
174.20.72.123:443
73.151.236.31:443
94.60.254.81:443
89.137.52.44:443
89.101.97.139:443
109.12.111.14:443
68.204.7.158:443
27.5.4.111:2222
129.208.177.244:995
105.198.236.99:995
65.100.174.110:8443
94.200.181.154:443
65.100.174.110:995
63.143.92.99:995
201.172.31.95:80
75.188.35.168:995
186.64.67.16:443
39.49.33.135:995
182.176.180.73:443
194.36.28.26:443
103.116.178.85:993
75.66.88.33:443
187.156.138.52:443
200.114.247.160:465
189.147.174.121:443
24.139.72.117:443
75.169.58.229:32100
5.31.189.54:995
86.120.85.147:443
93.48.80.198:995
2.222.167.138:443
197.89.6.112:443
27.57.252.156:443
103.150.40.76:995
41.228.22.180:443
81.250.153.227:2222
88.244.161.183:995
111.250.48.162:443
50.194.160.233:32100
50.194.160.233:443
24.55.112.61:443
73.140.38.124:443
108.4.67.252:443
176.63.117.1:22
100.1.119.41:443
24.229.150.54:995
111.91.87.187:443
86.97.10.14:443
220.255.25.187:2222
92.59.35.196:2222
72.252.201.34:465
209.210.95.228:443
68.186.192.69:443
187.121.105.111:995
103.168.241.157:995
103.168.241.157:465
86.190.203.103:443
93.147.212.206:443
5.238.149.217:61202
72.252.201.34:995
24.152.219.253:995
96.37.113.36:993
45.9.20.200:2211
190.73.3.148:2222
80.6.192.58:443
103.116.178.85:61200
93.48.58.123:2222
27.223.92.142:995
91.178.126.51:995
41.235.5.174:443
96.246.158.154:995
50.194.160.233:465
96.21.251.127:2222
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443
Unpacked files
SH256 hash:
4173ea66253fd8cea7decd6084a3d9f5da70ff380addbbef06ae2ab803bd18c0
MD5 hash:
fa3a836ccbed80e2885d9d28cc3c68b8
SHA1 hash:
284636f785129a7dba5b258d598b3a6b42939132
Link:
https://www.unpac.me/results/0d1c6502-40e1-4e74-98aa-5cd8c70c1298/
SH256 hash:
21646d1524ac6c2ff03f31480d00d8e9e3a706820c7e626f95da982dff80a5ae
MD5 hash:
52996718eaaf222cc8dc1dde8691ddf9
SHA1 hash:
bee92e5b731f468d31ab600cc658c0beba212cbe
Link:
https://www.unpac.me/results/0d1c6502-40e1-4e74-98aa-5cd8c70c1298/
SH256 hash:
268cf4bdbb872b24825068cc75677e51941b67003a7a589963715808e9f4728a
MD5 hash:
7a6a3e76b82c91fd849c17ab685b08f0
SHA1 hash:
a31030635e39da1d0e76b93c95e77f14af159c27
Link:
https://www.unpac.me/results/0d1c6502-40e1-4e74-98aa-5cd8c70c1298/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/268cf4bdbb87/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/268cf4bdbb872b24825068cc75677e51941b67003a7a589963715808e9f4728a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/210313/

Comments