MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28f9de318542ad888e2aa1759092b38017efe2c72a81b341827e71b1b9079760. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28f9de318542ad888e2aa1759092b38017efe2c72a81b341827e71b1b9079760
SHA3-384 hash: 2353a7c2c40f764933495f1f33967e2386e212390ff55e7acab585bedab612e566f57ce6fc74b530a00cc3e6a6c9198f
SHA1 hash: 996fe2b28604575316919075e23f6ad43ab54da1
MD5 hash: 56a9c03b5e70dc458c70726c21d2c4f2
humanhash: tennis-failed-mars-lake
File name:SecuriteInfo.com.Trojan.Win32.Save.a.32500.405
Download: download sample
Signature Quakbot
Create hunting rule
File size:422'856 bytes
First seen:2021-03-09 19:39:23 UTC
Last seen:2021-03-09 20:08:14 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash a8c48b50eb80b9c3117aa6794c839a62 (5 x Quakbot)
ssdeep 6144:xCL2m7+2BkmYCd5Zi6lMnieBdI0WDVdFL+GYheMGaNOF1N2JF6udTdytdynf5Ys3:x9nOnDKiePI0kvL3YEFH2JFBedw5jeg
Threatray 213 similar samples on MalwareBazaar
TLSH 9D94064F317D4451D0213B305C22B658DBFA2FE886765DDAAAD8482FDEE3244FC28766
Reporter SecuriteInfoCom
Tags:Qakbot qbot Quakbot signed

Code Signing Certificate

Organisation:LoL d.o.o.
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2021-02-26T00:00:00Z
Valid to:2022-02-26T23:59:59Z
Serial number: fed006fbf85cd1c6ba6b4345b198e1e6
Intelligence: 12 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 1cbce415a25c6021a37ebccc8d6fba903e6b861748279538f2d7fcb0bd013d1e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
312
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/123374/
Detection(s):
SecuriteInfo.com.Trojan.Win32.Save.a.32500.405.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a file in the Windows subdirectories
Launching a process
Modifying an executable file
Creating a process with a hidden window
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/633474
Signature
Allocates memory in foreign processes
Found malware configuration
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Schedule REGSVR windows binary
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 365706 Sample: SecuriteInfo.com.Trojan.Win... Startdate: 09/03/2021 Architecture: WINDOWS Score: 96 50 Found malware configuration 2->50 52 Sigma detected: Schedule REGSVR windows binary 2->52 54 Yara detected Qbot 2->54 56 2 other signatures 2->56 9 loaddll32.exe 1 2->9         started        11 regsvr32.exe 2->11         started        13 regsvr32.exe 2->13         started        process3 process4 15 regsvr32.exe 9->15         started        18 rundll32.exe 9->18         started        20 cmd.exe 1 9->20         started        22 regsvr32.exe 11->22         started        24 regsvr32.exe 13->24         started        signatures5 58 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 15->58 60 Injects code into the Windows Explorer (explorer.exe) 15->60 62 Writes to foreign memory regions 15->62 26 explorer.exe 8 1 15->26         started        64 Allocates memory in foreign processes 18->64 66 Maps a DLL or memory area into another process 18->66 29 explorer.exe 18->29         started        31 iexplore.exe 1 76 20->31         started        33 WerFault.exe 20 9 22->33         started        process6 file7 42 SecuriteInfo.com.T...32.Save.a.32500.dll, PE32 26->42 dropped 35 schtasks.exe 1 26->35         started        37 iexplore.exe 156 31->37         started        process8 dnsIp9 40 conhost.exe 35->40         started        44 img.img-taboola.com 37->44 46 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49738, 49739 FASTLYUS United States 37->46 48 7 other IPs or domains 37->48 process10
Gathering data
Threat name:
Win32.Trojan.GenCBL
Create hunting rule
Status:
Malicious
First seen:
2021-03-09 19:40:08 UTC
File Type:
PE (Dll)
Extracted files:
12
AV detection:
6 of 47 (12.77%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
0ea6564393fd9d17cd3153e67a46181b10d9a5fdada9203c23f6278c23916386
Quakbot
2bd9fd6b0e5a47bc10b4677e73838ed324ca07ae5cd2b67bf9fe1463a8b6113e
Quakbot
682027d2c4ef6117a50eee32a10bce20598ce5a92b81fbf6e100366137cc6606
Quakbot
6d10ae2b310fc8d3b8a2690afb40ff153ffca5f320a08d07c7d8b5a05a9dcd2c
Quakbot
89f295e3f67f0d1787dff3c18d74764fb354c09ad6ade10544577dfedc25e83d
Quakbot
c26c91b26296b34264a9f6435a7c4c127164ee6c6e3445d47995d119bce1340a
Quakbot
cd06ae3f12c3b04596addca4fc050ffaef068e16fe8896ba1a6a900b5641df15
Quakbot
df85f6d9b7786ff3ea72e3b8e465cee77ebd9c15f21851474f39ae64c28500e8
Quakbot
e004cc75cc35980ea51e7b8761be5aebea359a867cf815ba99057214fde84d01
Quakbot
ec9352eeb82834a128bd306eddc085b5138083a4ce1e98d847fd936a309b52cb
Quakbot
+ 203 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:biden10 campaign:1615296616 banker stealer trojan
Link:
https://tria.ge/reports/210309-j5m1xsseqs/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Loads dropped DLL
Qakbot/Qbot
Malware Config
C2 Extraction:
79.115.174.55:443
196.151.252.84:443
24.229.150.54:995
24.117.107.120:443
106.51.85.162:443
90.65.236.181:2222
184.189.122.72:443
47.196.192.184:443
136.232.34.70:443
80.227.5.69:443
195.12.154.8:443
105.198.236.101:443
190.85.91.154:443
83.110.103.152:443
83.196.56.65:2222
24.139.72.117:443
24.55.112.61:443
47.22.148.6:443
86.220.62.251:2222
83.110.9.71:2222
149.28.99.97:2222
149.28.101.90:995
149.28.99.97:443
45.63.107.192:2222
45.77.115.208:443
45.32.211.207:2222
45.32.211.207:995
45.77.117.108:995
45.77.117.108:8443
144.202.38.185:995
45.77.115.208:995
45.77.117.108:2222
149.28.98.196:443
149.28.99.97:995
207.246.77.75:995
207.246.77.75:2222
207.246.116.237:2222
207.246.116.237:995
45.77.117.108:443
144.202.38.185:2222
45.32.211.207:8443
207.246.116.237:443
45.77.115.208:2222
149.28.98.196:2222
78.63.226.32:443
84.247.55.190:8443
75.136.40.155:443
2.232.253.79:995
74.222.204.82:995
89.137.211.239:995
86.236.77.68:2222
77.27.204.204:995
193.248.221.184:2222
24.50.118.93:443
97.69.160.4:2222
106.51.52.111:443
196.221.207.137:995
213.60.147.140:443
106.250.150.98:443
76.94.200.148:995
140.82.49.12:443
24.95.61.62:443
195.43.173.70:443
197.45.110.165:995
87.202.87.210:2222
45.118.216.157:443
77.211.30.202:995
89.3.198.238:443
86.175.79.249:443
70.168.130.172:995
83.110.108.38:2222
71.117.132.169:443
84.72.35.226:443
59.90.246.200:443
95.77.223.148:443
149.28.101.90:443
207.246.77.75:8443
45.63.107.192:443
149.28.98.196:995
149.28.101.90:2222
207.246.116.237:8443
45.77.115.208:8443
149.28.101.90:8443
207.246.77.75:443
144.202.38.185:443
45.32.211.207:443
105.198.236.99:443
68.186.192.69:443
71.41.184.10:3389
217.133.54.140:32100
197.161.154.132:443
144.139.47.206:443
71.199.192.62:443
2.7.116.188:2222
172.78.30.215:443
75.67.192.125:443
115.133.243.6:443
202.188.138.162:443
81.97.154.100:443
71.163.223.159:443
176.181.247.197:443
41.39.134.183:443
122.148.156.131:995
67.6.12.4:443
73.25.124.140:2222
173.21.10.71:2222
92.59.35.196:2222
98.192.185.86:443
185.138.105.26:8443
203.198.96.215:443
144.139.166.18:443
216.201.162.158:443
173.25.45.66:443
96.21.251.127:2222
75.136.26.147:443
108.29.32.251:443
125.239.152.76:995
189.146.183.105:443
75.118.1.141:443
67.165.206.193:993
202.185.166.181:443
189.210.115.207:443
96.37.113.36:993
72.240.200.181:2222
151.205.102.42:443
109.12.111.14:443
186.31.77.42:443
71.197.126.250:443
72.252.201.69:443
108.46.145.30:443
74.68.144.202:443
24.43.22.218:993
199.19.117.131:443
188.26.91.212:443
181.48.190.78:443
98.252.118.134:443
189.222.59.177:443
45.46.53.140:2222
182.190.19.241:3389
209.210.187.52:443
98.240.24.57:443
78.97.207.104:443
82.12.157.95:995
125.209.114.182:443
174.104.22.30:443
182.48.193.200:443
125.63.101.62:443
2.50.16.111:2078
81.214.126.173:2222
71.74.12.34:443
Unpacked files
SH256 hash:
4b6c0e791ef2c61d4879c9a8717e9ad5fa2e3b0001bf9f121259ce486782e81e
MD5 hash:
c8ae2ca3dd253264d0643e95f7fb9d89
SHA1 hash:
ec7218f665048fd223faddb2ee69f031812d3a88
Link:
https://www.unpac.me/results/10afdd33-1eb8-4ef7-853b-afc24ab5b860/
SH256 hash:
28f9de318542ad888e2aa1759092b38017efe2c72a81b341827e71b1b9079760
MD5 hash:
56a9c03b5e70dc458c70726c21d2c4f2
SHA1 hash:
996fe2b28604575316919075e23f6ad43ab54da1
Link:
https://www.unpac.me/results/10afdd33-1eb8-4ef7-853b-afc24ab5b860/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/28f9de318542ad888e2aa1759092b38017efe2c72a81b341827e71b1b9079760

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/123374/

Comments