MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c5aed53fc06cf5447ad146396f7df699b64feaeec10355ce403ac3ba850cd76. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 8

Intelligence 8 IOCs YARA 4 File information Comments

SHA256 hash:	3c5aed53fc06cf5447ad146396f7df699b64feaeec10355ce403ac3ba850cd76
SHA3-384 hash:	c44e1cd3295585f1798eca7967865cc0b76690204df831cb132d3f37d8578aa2927b01e1e782425f79529b0974067334
SHA1 hash:	3500f645c494d3610d014add0c630171f50ce968
MD5 hash:	aa99a9543d31610891e609af8681ca20
humanhash:	river-florida-edward-diet
File name:	aa99a9543d31610891e609af8681ca20.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	1'537'536 bytes
First seen:	2021-01-08 08:00:42 UTC
Last seen:	2021-01-08 09:50:32 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	bc079b80e3dea46643ed8342d455966f (1 x Quakbot)
ssdeep	6144:HpsDm9m41qfMOSB5zMsP1DDK6DKFzz0DnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnS:aDp4dpMsNiAszz0+
Threatray	13 similar samples on MalwareBazaar
TLSH	3A65265DFBDA2F67D9A3867F14695436827FCDA60769FC039278F8498AF03E40720096
Reporter	abuse_ch
Tags:	dll Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

170

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/110917/

Detection(s):

SecuriteInfo.com.Trojan.Inject4.6511.12226.29724.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the Windows subdirectories

Launching a process

Modifying an executable file

Creating a process with a hidden window

Creating a window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3c5aed53fc06cf5447ad146396f7df699b64feaeec10355ce403ac3ba850cd76/

Threat name:

Win32.PUA.Wacapew

Status:

Malicious

First seen:

2021-01-08 08:01:09 UTC

AV detection:

17 of 46 (36.96%)

Threat level:

1/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hrno2u74a3hvir5ncrrzn567ngnwj7vo5qidkxheaowdxkcqzv3a._file

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:abc112 campaign:1608025881 banker stealer trojan

Link:

https://tria.ge/reports/210108-6d9hzmsg4n/

Behaviour

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Program crash

Loads dropped DLL

Qakbot/Qbot

Malware Config

C2 Extraction:

149.28.98.196:995
149.28.99.97:995
45.63.107.192:2222
144.202.38.185:995
144.202.38.185:443
45.63.107.192:995
5.13.84.186:995
68.83.89.188:443
67.141.11.98:443
219.76.148.249:443
86.245.82.249:2078
116.240.78.45:995
37.182.244.124:2222
72.186.1.237:443
78.97.207.104:443
80.14.22.234:2222
202.141.225.158:443
72.28.255.159:995
37.6.208.105:2222
161.142.217.62:443
188.253.85.49:995
217.165.3.30:443
90.61.38.208:2222
2.49.219.254:22
124.29.232.108:443
2.50.143.154:2222
2.50.2.216:443
197.161.154.132:443
103.76.160.110:443
51.223.138.251:443
102.185.13.89:443
85.101.187.146:443
92.154.83.96:2087
45.118.216.157:443
86.122.248.164:2222
92.154.83.96:1194
217.165.125.217:443
92.154.83.96:2078
85.105.29.218:443
151.60.38.21:443
156.213.217.254:443
2.50.57.224:443
217.162.149.212:443
182.161.6.57:3389
24.27.82.216:2222
37.166.181.234:0
45.77.115.208:2222
203.106.116.190:443
85.52.72.32:2222
2.51.240.250:995
2.91.9.248:443
101.109.175.33:443
41.228.47.147:443
78.101.199.138:995
125.63.101.62:443
90.53.103.26:2222
86.124.93.144:443
79.114.177.162:993
5.2.212.254:443
86.127.22.190:443
81.133.234.36:2222
5.15.109.245:443
37.130.115.124:443
2.50.88.125:995
62.38.114.12:2222
78.181.19.134:443
187.155.59.73:443
102.187.95.88:443
79.129.216.215:2222
141.237.135.194:443
42.117.61.10:443
93.148.241.179:2222
41.205.16.222:443
46.53.2.70:443
151.61.125.180:2222
151.73.121.136:443
176.181.247.197:443
149.28.101.90:8443
2.7.69.217:2222
84.117.176.32:443
109.205.204.229:2222
184.179.14.130:22
203.106.195.67:443
121.58.199.24:443
216.201.162.158:443
83.110.13.182:2222
172.87.157.235:3389
45.118.65.34:443
79.129.252.62:2222
2.50.30.147:995
2.50.159.104:2222
105.198.236.101:443
78.96.199.79:443
217.133.54.140:32100
172.91.19.192:443
196.204.207.111:443
77.132.113.187:2222
185.163.221.77:2222
197.49.240.8:995
45.77.115.208:8443
108.30.125.94:443
213.60.147.140:443
217.165.9.48:443
94.70.36.227:2222
59.99.36.20:443
104.37.20.207:995
5.193.106.230:2078
117.215.198.5:443
2.50.49.18:22
2.88.1.76:995
66.25.168.167:2222
173.21.10.71:2222
106.250.150.98:443
58.152.9.133:443
72.36.59.46:2222
89.137.211.239:995
96.241.66.126:443
93.86.1.159:995
95.76.27.6:443
217.128.117.218:2222
37.211.23.45:995
120.150.34.178:443
86.120.138.232:443
41.97.125.168:443
87.27.110.90:2222
82.76.47.211:443
94.69.242.254:2222
90.101.62.189:2222
78.187.125.116:2222
197.57.96.163:443
197.90.131.100:32100
5.193.178.36:2078
196.151.252.84:443
118.100.159.27:443
105.198.236.99:443
185.105.131.233:443
45.77.115.208:443
83.194.193.247:2222
41.233.152.232:993
197.45.110.165:995
86.97.221.121:443
78.154.31.238:443
37.21.231.245:995
108.190.194.146:2222
45.250.69.150:443
178.88.228.231:995
83.110.109.78:2222
85.204.189.105:443
198.2.35.226:2222
37.107.76.36:995

Unpacked files

SH256 hash:

3c5aed53fc06cf5447ad146396f7df699b64feaeec10355ce403ac3ba850cd76

MD5 hash:

aa99a9543d31610891e609af8681ca20

SHA1 hash:

3500f645c494d3610d014add0c630171f50ce968

Link:

https://www.unpac.me/results/ad5fde01-9355-4828-8aec-2f65fc5ac7bd/

SH256 hash:

ee8a7b2ced4ac4448c4958ae6168e096c74ac8a98a930280fdbf0ab538364e1a

MD5 hash:

0c5b549c16033540baaacc1449914fb2

SHA1 hash:

4e45632f83e908b94f8ac9475099b3ec4934239d

Link:

https://www.unpac.me/results/ad5fde01-9355-4828-8aec-2f65fc5ac7bd/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/3c5aed53fc06cf5447ad146396f7df699b64feaeec10355ce403ac3ba850cd76

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QakBot Create hunting rule
Author:	kevoreilly
Description:	QakBot Payload

Rule name:	qbot_bin Create hunting rule
Author:	James_inthe_box
Description:	Qbot Qakbot
Reference:	https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02

Rule name:	qbot_mem Create hunting rule
Author:	James_inthe_box
Description:	Qbot Qakbot
Reference:	https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02