MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments 1

SHA256 hash:	38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0
SHA3-384 hash:	a07deea23bc1d76345c45d39da12da95d0addf63a5fb551811b5d3a5671f01a83912c2d9c1bdec56703836baf16c161b
SHA1 hash:	61af6abea1cc27c2dff71d90af9e06de191d7aca
MD5 hash:	d36f24649f440cb0931cb3f2418a09d0
humanhash:	kansas-equal-queen-spring
File name:	Test.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	859'136 bytes
First seen:	2021-05-08 14:49:22 UTC
Last seen:	2021-05-08 15:52:35 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	f8b50da2e330b5dea32ae4760264b148 (3 x Quakbot)
ssdeep	12288:+LR2XCmohgp+8RhuxTyAK4X+PAj6iMRbM+bevd6CR/Vr8m+Bz5oKTxeEJuBnitAZ:+FaCz8nAO42HzhVeEJuBPOu+99z
Threatray	1'390 similar samples on MalwareBazaar
TLSH	B705BF22F2A1CC37D27326789E4B52646D39BE50F93899862FD41E486F343D13B36297
Reporter	LittleRedBean2
Tags:	dll Qakbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

126

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/153240/

Detection(s):

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Launching a process

Sending a UDP request

Modifying an executable file

Creating a process with a hidden window

Creating a window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

qbot

Link:

https://mwdb.cert.pl/sample/38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0/

Threat name:

Win32.Infostealer.QBot

Status:

Malicious

First seen:

2021-05-07 02:12:00 UTC

AV detection:

24 of 29 (82.76%)

Threat level:

5/5

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:clinton13 campaign:1620299491 banker stealer trojan

Link:

https://tria.ge/reports/210508-g2znmaw42a/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Loads dropped DLL

Qakbot/Qbot

Malware Config

C2 Extraction:

71.187.170.235:443
190.85.91.154:443
47.22.148.6:443
95.77.223.148:443
75.67.192.125:443
83.110.108.100:2222
81.97.154.100:443
97.69.160.4:2222
24.179.77.148:443
45.63.107.192:995
24.152.219.253:995
67.8.103.21:443
71.41.184.10:3389
184.185.103.157:443
73.25.124.140:2222
140.82.49.12:443
197.45.110.165:995
149.28.101.90:443
45.77.115.208:995
207.246.116.237:8443
45.77.117.108:443
216.201.162.158:443
149.28.98.196:443
144.202.38.185:995
45.77.115.208:2222
45.77.117.108:2222
45.77.117.108:995
144.202.38.185:2222
207.246.116.237:443
149.28.101.90:2222
149.28.101.90:8443
149.28.101.90:995
45.32.211.207:2222
207.246.77.75:2222
149.28.98.196:995
207.246.116.237:995
149.28.99.97:995
207.246.77.75:8443
45.77.115.208:8443
45.32.211.207:443
207.246.116.237:2222
45.32.211.207:995
149.28.98.196:2222
45.77.115.208:443
144.202.38.185:443
45.32.211.207:8443
45.77.117.108:8443
207.246.77.75:995
207.246.77.75:443
115.133.243.6:443
27.223.92.142:995
136.232.34.70:443
70.163.161.79:443
188.26.91.212:443
75.118.1.141:443
45.46.53.140:2222
50.244.112.106:443
144.139.47.206:443
50.29.166.232:995
76.25.142.196:443
173.21.10.71:2222
67.165.206.193:993
109.12.111.14:443
98.252.118.134:443
81.214.126.173:2222
72.252.201.69:443
189.210.115.207:443
73.151.236.31:443
72.240.200.181:2222
24.139.72.117:443
24.229.150.54:995
68.186.192.69:443
98.192.185.86:443
151.205.102.42:443
105.198.236.101:443
24.122.166.173:443
24.55.112.61:443
71.74.12.34:443
186.154.175.13:443
105.198.236.99:443
75.137.47.174:443
92.96.3.180:2078
24.95.61.62:443
172.78.54.78:443
47.196.198.43:443
71.163.222.158:443
149.28.99.97:2222
149.28.99.97:443
45.63.107.192:443
45.63.107.192:2222
92.59.35.196:2222
100.2.163.52:443
78.63.226.32:443
96.37.113.36:993
86.133.126.195:443
83.196.56.65:2222
195.6.1.154:2222
76.168.147.166:993
86.220.62.251:2222
90.65.236.181:2222
96.61.23.88:995
64.121.114.87:443
222.153.124.173:995
77.27.207.217:995
77.211.30.202:995
125.62.192.220:443
195.12.154.8:443
71.117.132.169:443
96.21.251.127:2222
71.199.192.62:443
70.168.130.172:995
82.12.157.95:995
209.210.187.52:995
209.210.187.52:443
67.6.12.4:443
189.222.59.177:443
174.104.22.30:443
142.117.191.18:2222
189.146.183.105:443
213.60.147.140:443
196.221.207.137:995
108.46.145.30:443
187.250.238.164:995
2.7.116.188:2222
195.43.173.70:443
106.250.150.98:443
45.67.231.247:443
83.110.103.152:443
83.110.9.71:2222
78.97.207.104:443
59.90.246.200:443
80.227.5.69:443
125.63.101.62:443
86.236.77.68:2222
109.106.69.138:2222
84.72.35.226:443
217.133.54.140:32100
197.161.154.132:443
89.137.211.239:995
74.222.204.82:995
122.148.156.131:995
156.223.110.23:443
144.139.166.18:443
202.185.166.181:443
76.94.200.148:995
71.63.120.101:443
196.151.252.84:443
202.188.138.162:443
74.68.144.202:443
69.58.147.82:2078

Unpacked files

SH256 hash:

d801c0315fe7000b64afcfc5d99e02342ba23a13458b1072c5b4dba0172fffc8

MD5 hash:

f344c6876f0660597f9dafeda976126b

SHA1 hash:

1128e8a4c4f415d7e32b7a6f71f358184281c0af

Detections:

win_qakbot_auto

Link:

https://www.unpac.me/results/0b9e37ca-9720-4168-9fd5-58489b6ae87b/

Parent samples :

71fd7986dd41906e1e868f60a1b89d9d591ea261c45a65848d94b07a0378e31b
38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0

SH256 hash:

38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0

MD5 hash:

d36f24649f440cb0931cb3f2418a09d0

SHA1 hash:

61af6abea1cc27c2dff71d90af9e06de191d7aca

Link:

https://www.unpac.me/results/0b9e37ca-9720-4168-9fd5-58489b6ae87b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

qbot

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/38b3ad4fa2d18bfe9e1d04c5fd24b06bcfcaac5f4ac376bfcfba23f45900f9d0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Delivery method

Other

Cape

https://www.capesandbox.com/analysis/153240/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-08 15:03:00 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
1) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
2) [B0012.001] Anti-Static Analysis::Argument Obfuscation
3) [F0002.002] Collection::Polling
5) [C0026.002] Data Micro-objective::XOR::Encode Data
7) [C0051] File System Micro-objective::Read File
8) [C0052] File System Micro-objective::Writes File
9) [E1510] Impact::Clipboard Modification
10) [C0007] Memory Micro-objective::Allocate Memory
11) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
12) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
13) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
14) [C0040] Process Micro-objective::Allocate Thread Local Storage
15) [C0038] Process Micro-objective::Create Thread
16) [C0041] Process Micro-objective::Set Thread Local Storage Value
17) [C0018] Process Micro-objective::Terminate Process