MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36398a8aa94465823750bf32568fa77ff9ffbc15b07ad6460d6d913b1b5bae78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 36398a8aa94465823750bf32568fa77ff9ffbc15b07ad6460d6d913b1b5bae78
SHA3-384 hash: 287e2aff6dd054175d33d3c34814eb5625b9c47c5e21d1cf7974afdba01ca41e51ab58f4067632e129e7b9768a0cc148
SHA1 hash: 87125c6dbc8631a4cbf788f009785cd237996bd8
MD5 hash: f76b8f1ba89287fb64595504e7770939
humanhash: angel-venus-william-helium
File name:user.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:2'048'000 bytes
First seen:2022-12-22 19:38:46 UTC
Last seen:2022-12-22 21:29:24 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash f7ec684b3b9ecfe69ca24d2cf5ad7af3 (1 x Quakbot)
ssdeep 49152:jDG9pmVnnyKKdmwLxSMKmc2qgI9Mprlcuhz6:vVVnnP8XLQL2q1YSu
TLSH T19C952221B482E031E79E143EA8AAC5B95A3E7D300B0408D777E07FAEDD706D19976F16
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter pr0xylife
Tags:1671561386 BB11 dll Qakbot qbot Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
220
Origin country :
IN IN
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/349137/
Detection(s):
SecuriteInfo.com.Win32.BotX-gen.31191.21385.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/63a4b259eb21110e8231795c/reports/3077004b-ac11-4c76-ae58-271a79c3f735/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/9b3a6082-07c7-4c47-9dca-66d21cd44f0e
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
spre.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1139565
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Execute DLL with spoofed extension
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 772295 Sample: user.dat.dll Startdate: 22/12/2022 Architecture: WINDOWS Score: 100 33 71.31.101.183 WINDSTREAMUS United States 2->33 35 216.36.153.248 WCG-ASCA Canada 2->35 37 98 other IPs or domains 2->37 39 Snort IDS alert for network traffic 2->39 41 Multi AV Scanner detection for submitted file 2->41 43 Yara detected Qbot 2->43 45 4 other signatures 2->45 9 loaddll32.exe 1 2->9         started        signatures3 process4 process5 11 rundll32.exe 9->11         started        14 rundll32.exe 9->14         started        16 cmd.exe 1 9->16         started        18 6 other processes 9->18 signatures6 51 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 11->51 53 Writes to foreign memory regions 11->53 55 Allocates memory in foreign processes 11->55 20 wermgr.exe 9 1 11->20         started        57 Maps a DLL or memory area into another process 14->57 22 wermgr.exe 14->22         started        24 rundll32.exe 16->24         started        27 WerFault.exe 2 9 18->27         started        29 WerFault.exe 24 9 18->29         started        process7 signatures8 47 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 24->47 49 Maps a DLL or memory area into another process 24->49 31 wermgr.exe 24->31         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/36398a8aa94465823750bf32568fa77ff9ffbc15b07ad6460d6d913b1b5bae78/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-12-22 19:39:09 UTC
File Type:
PE (Dll)
Extracted files:
84
AV detection:
18 of 26 (69.23%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gy4yvcvjirsyen2qx4zfnd5hp7477pavwb5nmrqnnwitwg23vz4a._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:bb11 campaign:1671561386 banker stealer trojan
Link:
https://tria.ge/reports/221222-ycybwsfb33/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
184.68.116.146:3389
92.189.214.236:2222
73.29.92.128:443
92.239.81.124:443
47.203.227.114:443
199.83.165.233:443
12.172.173.82:995
12.172.173.82:50001
136.244.25.165:443
37.15.128.31:2222
91.96.249.3:443
92.27.86.48:2222
75.156.125.215:995
93.147.134.85:443
86.176.246.195:2222
89.129.109.27:2222
70.55.120.16:2222
50.67.17.92:443
78.92.133.215:443
190.100.149.122:995
86.183.251.169:2222
184.68.116.146:2222
217.43.16.149:443
208.180.17.32:2222
75.143.236.149:443
70.64.77.115:443
76.184.95.190:993
73.161.176.218:443
84.35.26.14:995
67.235.138.14:443
206.166.209.170:2222
108.6.249.139:443
70.51.136.204:2222
67.253.226.137:995
201.137.206.40:443
176.44.121.220:995
31.48.67.240:443
80.103.77.44:2222
86.160.253.56:443
184.68.116.146:2078
76.80.180.154:995
181.118.183.50:443
173.178.151.233:443
72.80.7.6:995
109.220.196.24:2222
47.34.30.133:443
76.170.252.153:995
12.172.173.82:21
216.36.153.248:443
70.77.116.233:443
47.41.154.250:443
108.162.6.34:443
50.68.204.71:443
24.69.84.237:443
87.65.160.87:995
73.36.196.11:443
76.68.151.148:2222
89.203.252.238:443
81.131.210.167:443
96.255.66.51:995
12.172.173.82:465
95.23.15.84:2222
67.61.71.201:443
66.191.69.18:995
51.211.219.211:443
79.13.202.140:443
77.86.98.236:443
70.115.104.126:995
152.170.17.136:443
70.120.228.205:443
178.153.5.54:443
12.172.173.82:20
91.254.132.23:443
72.88.245.71:443
45.230.169.132:995
142.118.49.193:2222
65.95.85.172:2222
136.35.241.159:443
69.159.156.133:2222
92.8.187.85:2222
69.133.162.35:443
184.68.116.146:50010
86.130.9.250:2222
149.74.159.67:2222
176.133.4.230:995
46.10.198.106:443
2.14.96.234:2222
78.101.91.215:2222
92.154.45.81:2222
79.77.142.22:2222
12.172.173.82:22
12.172.173.82:32101
90.66.229.185:2222
86.225.214.138:2222
173.18.126.3:443
174.104.184.149:443
90.89.95.158:2222
162.248.14.107:443
190.249.241.149:443
78.18.42.55:443
184.68.116.146:61202
64.123.103.123:443
12.172.173.82:990
38.166.221.92:2087
184.176.154.83:995
92.207.132.174:2222
75.98.154.19:443
142.161.27.232:2222
84.113.121.103:443
90.104.22.28:2222
75.84.234.68:443
198.2.51.242:993
86.139.213.115:443
50.68.204.71:993
201.210.114.115:993
71.31.101.183:443
74.33.196.114:443
87.252.106.197:995
Unpacked files
SH256 hash:
914740a11b056401be005d19b45b7a795ff2c44d03ec2fc9c50813d43f999c1b
MD5 hash:
fe8a5b173ad990dbcc6826da2ffa253f
SHA1 hash:
fe2b0e4a8e85ea131f85cdb407033f4b1a27cee3
Link:
https://www.unpac.me/results/a41fd574-9708-401c-942a-6c415f49bb8e/
SH256 hash:
68d12f4a1b7a28eec2dc849cc82b08a5e45bc6fff0195413ce90403a106739d2
MD5 hash:
cfb44886b2dad562d827e4aeac5700c9
SHA1 hash:
5e4914c62bb7efe8bd5e07ca422223f2503edca6
Detections:
Qakbot
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/a41fd574-9708-401c-942a-6c415f49bb8e/
Parent samples :
22c5d9c52f3e9e072e384cc2963a7a453225c2ed7f26f60d0fb043c77f0c4079
88f2ca8f56c76d8689ec1738a23beb4ca30f43a3def3472de430f895805e7e48
36398a8aa94465823750bf32568fa77ff9ffbc15b07ad6460d6d913b1b5bae78
012747575632a83c77d73b90450612446664d78c5a6a1af082c5da1485f6e9e1
SH256 hash:
36398a8aa94465823750bf32568fa77ff9ffbc15b07ad6460d6d913b1b5bae78
MD5 hash:
f76b8f1ba89287fb64595504e7770939
SHA1 hash:
87125c6dbc8631a4cbf788f009785cd237996bd8
Link:
https://www.unpac.me/results/a41fd574-9708-401c-942a-6c415f49bb8e/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/36398a8aa944/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/36398a8aa94465823750bf32568fa77ff9ffbc15b07ad6460d6d913b1b5bae78

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/349137/

Comments