MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27fbfb86936343fc18bb61811401c96c052ecdff080da3bdb403545d55cf2b2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 27fbfb86936343fc18bb61811401c96c052ecdff080da3bdb403545d55cf2b2a
SHA3-384 hash: 7b563d3114a8a3abfbd99564d1599b947fd1410a34a94cab46a0ca454b16ec6a4e354a5daed5a79ea674cf728dec037c
SHA1 hash: dfb888ddad9c2111de010532f2539b9fddb99e7b
MD5 hash: 8f2fb30e75a8434382eddef86ecda768
humanhash: video-whiskey-alanine-charlie
File name:rhinitis.db
Download: download sample
Signature Quakbot
Create hunting rule
File size:669'184 bytes
First seen:2022-09-30 16:11:44 UTC
Last seen:2022-09-30 17:26:45 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash adb63404f98d8725720dc3b9811d9ace (1 x Quakbot)
ssdeep 12288:DzGUo9tIf1JUFR+NcGW4izhxSsB20HQ+n3VGo9lD0ZoggSVSK7t:DzG3QtiRgbWhbLdQG3VGonQo4t
TLSH T1BBE4AF90B6270CB2F85FA172202732398D3395B3BF5BC3463A5317B46C6B7A54D6CA85
TrID 29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4505/5/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter pr0xylife
Tags:BB dll Qakbot Quakbot

Intelligence

File Origin
# of uploads :
3
# of downloads :
268
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/315231/
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.15196.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Modifying an executable file
Creating a window
Unauthorized injection to a system process
Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/63371556dace43a378f3c987/reports/356b9039-4081-42a5-bebf-ffe78efd26ed/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/c8d343af-bd2e-458c-b62b-79039f9b1398
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/27fbfb86936343fc18bb61811401c96c052ecdff080da3bdb403545d55cf2b2a/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-09-30 16:12:13 UTC
File Type:
PE (Dll)
AV detection:
10 of 39 (25.64%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e757xbutmnb7ygf3mgariaojnqcs5tp7bag2hpnuankf2vopfmva._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/220930-tng2tseaf8/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
90.29.227.242:1085
212.204.93.86:48405
115.34.223.65:24926
250.151.244.173:3488
16.95.145.59:42025
50.6.212.181:17804
23.86.160.130:53103
212.133.85.240:62503
122.125.236.31:0
75.116.87.44:14933
64.55.103.194:9151
80.214.68.88:40730
97.184.129.40:2118
216.44.143.70:26851
239.39.127.10:38876
57.33.10.57:17737
201.128.252.151:58865
211.76.239.250:34506
124.58.65.86:13247
41.8.154.58:7614
6.55.240.195:27003
139.242.121.12:23370
8.81.30.103:64297
168.13.24.67:37382
17.219.125.20:59669
136.66.66.194:40287
63.172.177.141:57252
195.44.25.26:29277
67.212.106.154:59890
149.254.111.67:39052
184.74.22.12:50436
166.33.149.229:19515
172.102.164.60:43562
155.28.49.2:51545
7.122.114.191:33775
220.68.130.196:7948
121.236.113.177:14197
47.2.191.47:32393
49.93.218.109:41033
174.124.34.188:14831
178.143.168.245:48707
159.196.166.193:58136
1.104.105.37:49572
225.108.223.250:46683
105.208.24.120:59473
180.179.25.125:42514
236.83.216.21:0
Unpacked files
SH256 hash:
859ce229f8e356ce1e2b434426c5ca62ac1267b1d850a062ec2a429a4010c323
MD5 hash:
5471b1b03322632a7dc1e906a894204e
SHA1 hash:
46f702dc703a6c4ea6e8a68addc5dee530e37da4
Link:
https://www.unpac.me/results/d779220d-ae2c-4b84-9f22-2e284d3f70be/
SH256 hash:
d3a181c293f48dc67b7e3af011b848aab0d4c0120c8c63d6226a9e898e10a058
MD5 hash:
6cca93e3169f639175765080e83af3b1
SHA1 hash:
b037128aad201a47c481a448eb677b1529dc7962
Detections:
Qakbot
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/d779220d-ae2c-4b84-9f22-2e284d3f70be/
SH256 hash:
27fbfb86936343fc18bb61811401c96c052ecdff080da3bdb403545d55cf2b2a
MD5 hash:
8f2fb30e75a8434382eddef86ecda768
SHA1 hash:
dfb888ddad9c2111de010532f2539b9fddb99e7b
Link:
https://www.unpac.me/results/d779220d-ae2c-4b84-9f22-2e284d3f70be/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/27fbfb869363/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/27fbfb86936343fc18bb61811401c96c052ecdff080da3bdb403545d55cf2b2a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:unpacked_qbot
Create hunting rule
Description:Detects unpacked or memory-dumped QBot samples
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.
Rule name:win_qakbot_malped
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/315231/

Comments