🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42bc9b623f70e46d6aab4910d8c75221aecf89a00756a61b21f952eea13a446c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 42bc9b623f70e46d6aab4910d8c75221aecf89a00756a61b21f952eea13a446c
SHA3-384 hash: 6b1535c78d3c01fb331cb25f910e90f3e01ac0134c3db6e92cb8bdd2bd441a07c3ef67d8e2a2e5cae749368999cbc414
SHA1 hash: b83220371e18d131ca3fd0f748a738cdfbbf53a2
MD5 hash: 7646721b442e02db2e414b1b39d39331
humanhash: september-white-one-sweet
File name:42bc9b623f70e46d6aab4910d8c75221aecf89a00756a61b21f952eea13a446c
Download: download sample
Signature Quakbot
Create hunting rule
File size:686'576 bytes
First seen:2022-07-09 07:13:01 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash b3eb5f2cb0e5c330158023ae1978afd1 (12 x Quakbot)
ssdeep 12288:jHl4sryeYLd4LtvckUzl/Fcdjhvmr7UTGoChBQjLU:zmYYLd4dseunUGoBLU
TLSH T11BE49F26F7D08833D27316389C5B63A4A8357E50293868962FFC2E4C4F39B817A75797
TrID 47.6% (.EXE) Win32 Executable Delphi generic (14182/79/4)
15.1% (.EXE) Win32 Executable (generic) (4505/5/1)
10.0% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
6.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (573 x Quakbot, 337 x GCleaner, 137 x ArkeiStealer)
Reporter JAMESWT_WT
Tags:dll Quakbot signed TOPFLIGHT GROUP LIMITED

Code Signing Certificate

Organisation:TOPFLIGHT GROUP LIMITED
Issuer:Sectigo Public Code Signing CA R36
Algorithm:sha384WithRSAEncryption
Valid from:2022-06-24T00:00:00Z
Valid to:2023-06-24T23:59:59Z
Serial number: 5b1f9ec88d185631ab032dbfd5166c0d
Intelligence: 12 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: a46234c01e9f9904e500aefad4b5718d86aaec4e084b3d8ffbfe5724f8ddda45
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
329
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/285778/
Detection(s):
SecuriteInfo.com.W32.Qbot.CU.genEldorado.26606.11406.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/62c92abe76fa5a59945051bb/reports/fd3ff9f7-96a1-41d0-9286-a46b7cb16d0b/overview
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/0ab110b1-3b38-4bf3-b04d-df040f39214a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/42bc9b623f70e46d6aab4910d8c75221aecf89a00756a61b21f952eea13a446c/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-07-08 22:10:59 UTC
File Type:
PE (Dll)
Extracted files:
38
AV detection:
18 of 25 (72.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ik6jwyr7odsg22vljeinrr2segxm7cnaa5lkmgzb7fjo5ij2irwa._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama199 campaign:1657265474 banker stealer trojan
Link:
https://tria.ge/reports/220709-h13nhsfcg2/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Program crash
Qakbot/Qbot
Malware Config
C2 Extraction:
121.7.223.45:2222
67.209.195.198:443
148.64.96.100:443
92.132.132.81:2222
217.128.122.65:2222
47.180.172.159:443
173.174.216.62:443
70.46.220.114:443
32.221.224.140:995
69.14.172.24:443
117.248.109.38:21
94.59.15.180:2222
38.70.253.226:2222
217.165.157.202:995
41.228.22.180:443
67.165.206.193:993
172.115.177.204:2222
186.90.153.162:2222
47.23.89.60:993
120.150.218.241:995
93.48.80.198:995
89.211.209.234:2222
197.89.12.70:443
208.107.221.224:443
24.178.196.158:2222
66.230.104.103:443
118.161.14.242:995
24.158.23.166:995
100.38.242.113:995
37.208.132.76:50010
63.143.92.99:995
182.191.92.203:995
86.97.246.166:1194
74.14.5.179:2222
40.134.246.185:995
111.125.245.116:995
173.21.10.71:2222
76.25.142.196:443
142.186.49.224:2222
118.161.14.242:443
174.69.215.101:443
187.172.164.12:443
129.208.151.177:995
70.51.137.244:2222
190.252.242.69:443
24.55.67.176:443
103.246.242.202:443
89.101.97.139:443
47.156.129.52:443
72.252.157.93:993
72.252.157.93:990
72.252.157.93:995
177.94.65.26:32101
24.139.72.117:443
82.41.63.217:443
179.158.105.44:443
81.132.186.218:2078
201.172.20.167:2222
37.186.58.99:995
37.34.253.233:443
125.25.133.223:443
45.241.254.69:993
39.49.41.221:995
196.203.37.215:80
88.240.59.52:443
39.44.60.200:995
86.97.10.37:443
86.98.157.114:993
109.12.111.14:443
81.193.30.90:443
39.52.59.221:995
39.41.16.210:995
106.51.48.188:50001
86.97.209.138:2222
104.34.212.7:32103
86.213.75.30:2078
45.46.53.140:2222
39.57.56.11:995
84.241.8.23:32103
2.178.166.220:61202
24.43.99.75:443
101.50.67.155:995
41.13.224.28:443
108.56.213.219:995
189.253.167.141:443
5.32.41.45:443
120.61.1.141:443
177.189.180.214:32101
94.36.193.176:2222
39.53.124.57:995
80.11.74.81:2222
41.84.224.109:443
103.116.178.85:995
209.15.76.228:443
184.97.29.26:443
102.65.66.66:443
39.52.221.9:995
191.112.26.57:443
210.246.4.69:995
Unpacked files
SH256 hash:
36bc097350542748d1b1eaec575e3518e295c486c432608f0e0646942776a8de
MD5 hash:
716b2612c4296c72635872d7f5f5e6fa
SHA1 hash:
ba9062560f597bd7329b4c1454b429cfbf490d6c
Link:
https://www.unpac.me/results/03ed948f-1217-4405-becb-9b1ce5ed7645/
SH256 hash:
50d778ca9ec1749e645423deff1642c8c8513cd5a2090114b34078bcbfa14b8f
MD5 hash:
85f4770f6bfd7717f612c330974773e2
SHA1 hash:
5462429ecf47cd3f7d54efdb96e1e8ed38ffe094
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/03ed948f-1217-4405-becb-9b1ce5ed7645/
Parent samples :
1beb6f15f403fe31392012b506ce1bb38424482d3e8123f0f80ae439484fffe7
08f07f31eeba10e1139b287914bc0909cf64e40d51c84a8158365577f2126b4b
18fd119493272ee301e6f57417f64a89a9f4aa976ab8b940d12dea133ed9400e
5d62cbd1c137333a510d67a26d86ef27a0230a421f25516cfcb6df49cc91c953
357b994cf1840ccd15970656a2c42d5fa3491be76e08d063c9e7ca4b9c334da6
9e861f282623eca8634fb8e0486661f06f96b5f0d0ca5ee48ddc4bfa9b86cb36
4700092298655bf5ab6611727799d456e33dfecbe25f87d8391f73fe2c0480c3
d554cf5e1dd65dc5d013e04bce060bbe8029302c0da6d02fad3f58010c5a554b
595bc8cfd93e82a7e3b5f61f8087519f138c6c833a462ee3bde033e759e53045
09a4b39c319f0ce6f3bf25a23be3cc6bd57d4597ec5b498b56f45a74ccee73c8
80848c46e198bc29dad7f89e472b9766ea19a1d0e7def5c6535edc28f5699e36
42bc9b623f70e46d6aab4910d8c75221aecf89a00756a61b21f952eea13a446c
SH256 hash:
42bc9b623f70e46d6aab4910d8c75221aecf89a00756a61b21f952eea13a446c
MD5 hash:
7646721b442e02db2e414b1b39d39331
SHA1 hash:
b83220371e18d131ca3fd0f748a738cdfbbf53a2
Link:
https://www.unpac.me/results/03ed948f-1217-4405-becb-9b1ce5ed7645/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/42bc9b623f70/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/42bc9b623f70e46d6aab4910d8c75221aecf89a00756a61b21f952eea13a446c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/285778/

Comments