MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 33b931c8f19d3ef8b354cc7ca24ebfbb2cdf2b83e5717b1dd7c81cef80238591. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 33b931c8f19d3ef8b354cc7ca24ebfbb2cdf2b83e5717b1dd7c81cef80238591
SHA3-384 hash: f0316cf20cfea61ba344ce69f9d5beebc573bc84bdd316be0a4d49bc49b0b774d80ba1a3535d80d1a27d2b87a499e782
SHA1 hash: cba5906ccfe6346aea95dd6423c4a6c4f1231771
MD5 hash: 7270108facd5a2a3f767ef0605cf2572
humanhash: tango-salami-oven-hawaii
File name:SecuriteInfo.com.W32.AIDetect.malware1.29648.1313
Download: download sample
Signature Quakbot
Create hunting rule
File size:290'304 bytes
First seen:2021-02-26 10:49:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2b9d977cdb96a86271ca820249444adc (1 x Gozi, 1 x Quakbot)
ssdeep 6144:GSyWIv6ZMnqLr5snwOaUVxefoWby719ML9X:GOu6ZMnArCwOaUPefoWOp9
TLSH 2E546C21ABA2D034F2F356B859BD52E8793E79B177309CCF92C116EA5A346E09C30753
Reporter SecuriteInfoCom
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SecuriteInfo.com.W32.AIDetect.malware1.29648.1313
Verdict:
No threats detected
Analysis date:
2021-02-26 12:59:57 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/84905bf2-ad48-40ac-b988-9b2c77fae9fd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Ursnif3
Create hunting rule
Link:
https://www.capesandbox.com/analysis/119385/
Detection(s):
SecuriteInfo.com.W32.AIDetect.malware1.29648.1313.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Launching a process
Creating a window
Sending a UDP request
DNS request
Searching for the window
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
isfb
Create hunting rule
Link:
https://mwdb.cert.pl/sample/33b931c8f19d3ef8b354cc7ca24ebfbb2cdf2b83e5717b1dd7c81cef80238591/
Threat name:
Win32.Trojan.Azorult
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 10:50:13 UTC
AV detection:
19 of 28 (67.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=go4tdshrtu7prm2uzr6ketv7xmwn6k4d4vyxwhoxzaoo7abdqwiq._file
Result
Malware family:
gozi_ifsb
Create hunting rule
Score:
  10/10
Tags:
family:gozi_ifsb botnet:6565 banker trojan
Link:
https://tria.ge/reports/210226-an45d269qa/
Behaviour
Discovers systems in the same network
Enumerates processes with tasklist
Gathers system information
Modifies Internet Explorer settings
Runs net.exe
Runs ping.exe
Suspicious behavior: CmdExeWriteProcessMemorySpam
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Suspicious use of SetThreadContext
Deletes itself
Gozi, Gozi IFSB
Malware Config
C2 Extraction:
updates.microsoft.com
klounisoronws.xyz
darwikalldkkalsld.xyz
c1.microsoft.com
ctldl.windowsupdate.com
195.123.209.122
185.82.218.23
5.34.183.180
bloombergdalas.xyz
groovermanikos.xyz
kadskasdjlkewrjk.xyz
Unpacked files
SH256 hash:
ba63c14d0972a3bed8b8813954b4ddeaa8ef733afac9ed3a86372bfc87a2aa97
MD5 hash:
01bbf9a59beeb52288bdec21980db6e7
SHA1 hash:
ca85f5df9b2572f5a1606eeabee646dc871a9712
Detections:
win_isfb_auto
Create hunting rule
Link:
https://www.unpac.me/results/74867065-ab78-4448-a0b7-b4d92728682e/
Parent samples :
77e3afaec1b7b091e7f1fd3bbfac6aa65216e60d6b6f3c866304913278470f61
33b931c8f19d3ef8b354cc7ca24ebfbb2cdf2b83e5717b1dd7c81cef80238591
9d40d8e5b54507f1e857aaa2c16fd22b7e3eb3c87a72d33a649bd9bc382a21b4
e789b72e2160d3c51e6ab89c99d8bb1075f380f875e8a7bfc8dae20eff3e8388
f7c8f22c944ad9bcf149348cbbe8f404fc69b58fe15977245fc2413f6e327e09
267d3265b48b05aeb6ea82ca0f6ba1766108ecab9d7e2a5803c92ea055c53428
1592f542473e48b5a4ceac2f276254d0e8c4c7f820e500979f2a787bb6e32507
SH256 hash:
ad94fc6d7f195674d3801b77edf4a2e34baae61d7aeb68ee9bd714cc9526738d
MD5 hash:
cfd3d7ea0f45df977a933d17ddf2240a
SHA1 hash:
6ae439e047eba9cbbbe241e1959de3af17a0ce1a
Link:
https://www.unpac.me/results/74867065-ab78-4448-a0b7-b4d92728682e/
SH256 hash:
33b931c8f19d3ef8b354cc7ca24ebfbb2cdf2b83e5717b1dd7c81cef80238591
MD5 hash:
7270108facd5a2a3f767ef0605cf2572
SHA1 hash:
cba5906ccfe6346aea95dd6423c4a6c4f1231771
Link:
https://www.unpac.me/results/74867065-ab78-4448-a0b7-b4d92728682e/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_isfb_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

Executable exe 33b931c8f19d3ef8b354cc7ca24ebfbb2cdf2b83e5717b1dd7c81cef80238591

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/119385/
  
URLhaus
https://urlhaus.abuse.ch/url/1030978/
  
Delivery method
Distributed via web download

Comments