MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 283318a272b4164ad445104b29583a873b16e9d5f8c5976e994f513cd3390fd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 11


Intelligence 11 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 283318a272b4164ad445104b29583a873b16e9d5f8c5976e994f513cd3390fd3
SHA3-384 hash: 01b38eb3b9adbdf8f50ebb7d989573f85b822ec4672512fba64489afe5b625cf756577fc80f9d975ad270c10769c6e5b
SHA1 hash: 849c147798d3ffdb857d8466ec8ffa2464fc8158
MD5 hash: fd4c8a2bb4ae21930226d390191d197e
humanhash: eight-apart-stream-mississippi
File name:44519.7349467593.dat.dll
Download: download sample
Signature Quakbot
Create hunting rule
File size:516'096 bytes
First seen:2021-11-19 17:41:29 UTC
Last seen:2021-11-19 20:07:43 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 800cd180252b50e4e4bde81ea61887f4 (2 x Quakbot)
ssdeep 12288:KkOcqDoaYh0JYv+w27pFRm4x9v0Pz5bBD:KTcq+0J2+/paclo5
Threatray 375 similar samples on MalwareBazaar
TLSH T19EB49F26F2D08837C27336B89C5B5764A836BE513D2D78C62BE41E4C4F397813B69297
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter James_inthe_box
Tags:dll Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
192
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan0058a0791.11145.14835.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching a process
DNS request
Modifying an executable file
Creating a process with a hidden window
Sending a custom TCP request
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
keylogger packed
Link:
https://www.filescan.io/uploads/6197e1ec43e8f62b669ab629/reports/acb43192-0966-4b0a-b13d-9ed1fb309cdb/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5163169b-2a3a-46f5-9db4-e3010af4452f
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/892833
Signature
Allocates memory in foreign processes
Contains functionality to detect sleep reduction / modifications
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Execute DLL with spoofed extension
Sigma detected: Suspicious Svchost Process
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/283318a272b4164ad445104b29583a873b16e9d5f8c5976e994f513cd3390fd3/
Threat name:
Win32.Trojan.KBot
Create hunting rule
Status:
Malicious
First seen:
2021-11-19 17:41:15 UTC
File Type:
PE (Dll)
Extracted files:
41
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fazrritswqlevvcfcbfsswb2q45rn2ov7dczo3uzj5itzuzzb7jq._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
2b06b75f6b51eb26fccc795e4a8f7923119ddf60d4a6f3170c1867cf8dc62fb0
Quakbot
3cde8a896848e9c28ccfcc2db7812602143de7be90aa44fcfe83c85ac7e53f9b
Quakbot
421082e36a21c830cc0c12eb9dcbebaa13b5cc42008c1dc29c643d83df76ffb0
Quakbot
78abc92488d49165ca64ad2a169febbdba6ca105cb6fe18b02c660b6fb867588
Quakbot
c280803318fcc959993a058b17616e02a2101b910287033a8f26559c94277f69
Quakbot
c7a0cf59d0df795f6fc9383cfdeb2335b658ea12ad6ea8a5b69a211601ff975d
Quakbot
+ 365 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama132 campaign:1637316939 banker evasion stealer trojan
Link:
https://tria.ge/reports/211119-v9179sbbbm/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
176.45.246.154:995
177.76.159.233:995
136.143.11.232:443
39.49.71.230:995
140.82.49.12:443
136.232.34.70:443
218.101.110.3:995
186.64.67.17:443
45.9.20.200:2211
188.27.119.243:443
72.252.201.34:465
111.250.51.232:443
117.198.149.90:443
2.222.167.138:443
103.142.10.177:443
190.73.3.148:2222
89.137.52.44:443
123.252.190.14:443
197.87.144.239:443
89.101.97.139:443
209.210.95.228:443
194.36.28.26:443
117.248.109.38:21
182.176.180.73:443
24.152.219.253:995
207.246.112.221:443
207.246.112.221:995
216.238.71.31:443
220.255.25.187:2222
93.48.80.198:995
173.21.10.71:2222
71.74.12.34:443
75.188.35.168:995
73.151.236.31:443
96.37.113.36:993
189.135.61.226:443
75.169.58.229:32100
50.194.160.233:443
200.127.27.220:465
100.1.119.41:443
201.172.31.95:80
65.100.174.110:8443
72.252.201.34:995
103.116.178.85:61200
24.229.150.54:995
189.147.225.12:443
50.194.160.233:32100
105.198.236.99:995
73.171.4.177:443
86.8.177.143:443
24.55.112.61:443
93.48.58.123:2222
120.150.218.241:995
94.60.254.81:443
41.228.22.180:443
76.25.142.196:443
24.139.72.117:443
109.12.111.14:443
103.150.40.76:995
81.250.153.227:2222
5.193.134.177:995
68.204.7.158:443
217.165.237.204:443
78.191.34.234:995
86.97.160.193:443
27.223.92.142:995
45.46.53.140:2222
102.65.38.57:443
91.178.126.51:995
2.178.83.247:61202
101.50.103.248:995
80.6.192.58:443
27.5.5.31:2222
41.235.5.174:443
96.246.158.154:995
94.200.181.154:443
50.194.160.233:465
176.63.117.1:22
68.186.192.69:443
96.21.251.127:2222
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443
162.244.227.45:443
75.66.88.33:443
86.173.96.86:443
78.153.126.175:443
206.47.134.234:2222
93.147.212.206:443
71.13.93.154:2083
178.239.56.80:443
63.143.92.99:995
189.223.33.109:443
71.13.93.154:6881
81.174.162.180:995
103.143.8.71:995
73.140.38.124:443
79.160.207.214:443
83.223.164.163:443
71.13.93.154:2222
115.96.64.9:995
103.116.178.85:993
67.165.206.193:993
178.51.47.120:995
189.146.127.83:443
92.59.35.196:2222
Unpacked files
SH256 hash:
eabd14b6aad95af1293fb97efa6b61fdf60f813e7c3801aeaeeb229176ae9d74
MD5 hash:
73cc145585990db1760bc477f7713ede
SHA1 hash:
072bd7bc122359ec819601614e8dfa22416d9d6d
Link:
https://www.unpac.me/results/34ffec3f-2fd2-4e2d-9d35-cb1dec5244ab/
SH256 hash:
283318a272b4164ad445104b29583a873b16e9d5f8c5976e994f513cd3390fd3
MD5 hash:
fd4c8a2bb4ae21930226d390191d197e
SHA1 hash:
849c147798d3ffdb857d8466ec8ffa2464fc8158
Link:
https://www.unpac.me/results/34ffec3f-2fd2-4e2d-9d35-cb1dec5244ab/
Malware family:
CryptOne
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/283318a272b4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/283318a272b4164ad445104b29583a873b16e9d5f8c5976e994f513cd3390fd3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/207658/

Comments