MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e866bc6bed961f6aecba1d1b1427a78911da9be507f6e7a31e9cf9332cad8a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	2e866bc6bed961f6aecba1d1b1427a78911da9be507f6e7a31e9cf9332cad8a4
SHA3-384 hash:	c35ebdd82ed09655513a92bff94a3f90b32be66154a7f6ff9fad84e0111a8a4ef7a1093d71cf3bedaa84e46e8c75760d
SHA1 hash:	6e1a3becbad6b32ef31b138c5e91d7244a63c69f
MD5 hash:	d07396fa9c529b4b74a9c27f40a17fe7
humanhash:	william-two-nuts-ack
File name:	8888888.png_
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	715'264 bytes
First seen:	2020-05-25 08:46:49 UTC
Last seen:	2020-05-25 10:17:09 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	7f9fa8710112296c7b7c4f862b26b451 (2 x Quakbot)
ssdeep	12288:SDMAVaFgq6LuM+0D2PNEtRbHE0CbdLI/9:CaFgdnUVEnlCB
Threatray	437 similar samples on MalwareBazaar
TLSH	FDE4CE17692F9F6FFFCA723551ACF5B1A916FF4C1327A8323910B4A9B1A129B0135702
Reporter	oppimaniac
Tags:	Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Troj.Qbot-FS.8678.7477.UNOFFICIAL

Gathering data

Threat name:

Win32.Trojan.Qbot

Status:

Malicious

First seen:

2020-05-25 09:36:08 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

29 of 31 (93.55%)

Threat level:

5/5

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:spx124 campaign:1590052330 banker cryptone evasion packer stealer trojan

Link:

https://tria.ge/reports/201109-f99m9gds2a/

Behaviour

Creates scheduled task(s)

Modifies data under HKEY_USERS

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Loads dropped DLL

Executes dropped EXE

CryptOne packer

Qakbot/Qbot

Turns off Windows Defender SpyNet reporting

Windows security bypass

Malware Config

C2 Extraction:

188.173.185.139:443
117.241.53.130:443
81.103.144.77:443
217.219.50.172:990
103.76.160.110:443
68.204.164.222:443
98.32.60.217:443
173.245.152.231:443
72.240.245.253:443
112.171.126.153:443
141.85.114.172:443
31.5.189.71:443
71.77.231.251:443
72.190.101.70:443
140.82.21.191:443
31.5.41.52:443
78.188.109.130:443
70.124.29.226:443
24.43.22.220:993
101.108.114.66:443
137.103.143.124:443
203.213.104.25:995
182.56.134.44:995
24.201.79.208:2078
24.110.96.149:443
98.222.23.221:443
50.104.186.71:443
67.83.54.76:2222
104.36.135.227:443
68.1.171.93:443
24.43.22.220:995
75.183.171.155:3389
47.41.3.40:443
68.98.142.248:995
81.133.234.36:2222
98.121.187.78:443
47.205.231.60:443
66.26.160.37:443
69.92.54.95:995
67.209.195.198:3389
41.228.231.93:443
184.98.104.7:995
72.204.242.138:6881
210.61.141.92:443
35.142.12.163:2222
24.46.40.189:2222
96.56.237.174:993
189.231.179.154:443
98.115.138.61:443
50.29.166.232:995
173.79.220.156:443
70.174.3.241:443
47.146.169.85:443
50.29.181.193:995
216.110.249.252:2222
76.117.227.153:443
98.118.156.172:443
70.173.46.139:443
79.114.195.15:443
75.110.250.89:443
50.96.232.242:995
203.106.194.13:443
47.232.26.181:443
47.180.66.10:443
71.8.33.238:443
71.241.247.189:443
71.80.66.107:443
207.255.161.8:2222
173.173.68.41:443
116.202.36.62:21
68.46.142.48:443
100.40.48.96:443
47.136.224.60:443
98.173.34.212:995
197.37.177.211:993
185.145.113.249:443
95.77.223.148:443
72.204.242.138:20
68.60.221.169:465
72.204.242.138:2087
72.69.180.183:61202
68.4.137.211:443
72.204.242.138:53
59.124.10.133:443
171.97.10.201:2222
188.214.99.182:995
102.190.173.155:6881
108.58.9.238:443
188.173.214.88:443
66.76.255.133:2078
41.129.128.231:443
5.15.237.243:443
50.244.112.10:443
72.204.242.138:443
72.204.242.138:2078
72.204.242.138:990
102.41.118.44:995
47.153.115.154:443
68.149.64.58:2222
207.255.161.8:995
207.255.161.8:2078
73.76.47.127:443
76.187.97.98:2222
5.14.251.226:443
65.116.179.83:443
96.35.170.82:2222
84.117.60.157:443
108.58.9.238:993
207.255.161.8:2087
142.129.227.86:443
37.8.32.154:443
24.96.22.21:443
207.255.161.8:32102
1.40.42.4:443
108.58.9.238:995
74.33.69.208:443
66.222.88.126:995
47.152.210.233:443
24.99.180.247:443
50.244.112.106:443
172.242.156.50:443
67.131.59.17:443
24.10.42.174:443
190.198.125.194:2078
49.191.9.180:995
41.96.210.164:443
50.247.230.33:995
76.170.77.99:443
70.183.127.6:995
66.68.22.151:443
97.127.144.203:2222
137.99.224.198:443
209.182.121.133:2222
50.78.93.74:443
72.204.242.138:50003
79.101.206.85:995
24.122.228.88:443
24.213.191.38:0
50.246.229.50:443
203.33.139.134:443
75.137.60.81:443
207.255.161.8:443
24.229.245.124:995
24.43.22.220:443
172.78.87.180:443
67.0.73.239:443
79.116.237.126:443
47.155.19.205:443
75.81.25.223:443
31.5.21.66:443

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_qakbot_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample