MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14
SHA3-384 hash:	5e7c351d3c8c6d8a2aa0f086b46571188f372c39528a796f05b69ee7252305dde386d6c382219db258e725b66a8ce0f0
SHA1 hash:	2eca78e78bdc00e02da0a7328a3c57176cf3c011
MD5 hash:	da51dd657868bf4d2924b4398e045b27
humanhash:	stream-ten-charlie-virginia
File name:	4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	612'680 bytes
First seen:	2022-09-08 12:17:30 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	0d971731f29ea2e5723c4a2414a00dce (2 x Quakbot)
ssdeep	12288:hzF6eBVYHBQ3DvlYuZ+wNvYyujPt5ABJXT+gO:ho1HBuKuj61D4XTK
Threatray	1'347 similar samples on MalwareBazaar
TLSH	T15ED49E23E2E04837D377167C9D1B67ACA8367E512A38A8562BF41D486F3D2C0357A397
TrID	47.6% (.EXE) Win32 Executable Delphi generic (14182/79/4) 15.1% (.EXE) Win32 Executable (generic) (4505/5/1) 10.0% (.MZP) WinArchiver Mountable compressed Archive (3000/1) 6.9% (.EXE) Win16/32 Executable Delphi generic (2072/23) 6.8% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter	ffforward
Tags:	dll FJJGRZHNSCPISZVYBX Qakbot qbot Quakbot snow01

Intelligence

File Origin

# of uploads :

# of downloads :

324

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/308770/

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.61810984.7522.23282.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Searching for synchronization primitives

Sending a custom TCP request

Сreating synchronization primitives

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

greyware kbot keylogger overlay packed qakbot qbot

Link:

https://www.filescan.io/uploads/6319dd7fa90642bcbbef5a23/reports/9387168c-dee0-4d65-9fe6-1932f3137200/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Qakbot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/91d24425-214b-4a55-9933-98649b3a6a3d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14/

Threat name:

Win32.Backdoor.Quakbot

Status:

Malicious

First seen:

2022-09-06 16:06:43 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

23 of 26 (88.46%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=j4j5gumaxbjgdksjxuuavzjmn72qd7gcetwnr73ss2ltg7quzyka._file

Verdict:

malicious

Label(s):

qakbot

Quakbot

5fe5acb2467c0b99e0bc07c7c661af29ab23da9388e356b0c6fb64037debe7a4

Quakbot

7d436b6200af103cb2fba472e95972dfb5475feb65d485720d0c547ca00c2547

Quakbot

a5a163e436995c01536396d65e775a72250b63e4c16ea59283e04fb609d248b1

Quakbot

c0ba083bff21c52e20f97ffb1d20ada082e328d6a4f5561c10f4944f9187d375

Quakbot

dcd14c38adfeaf976dbf3aacce00d5e664e007fd3ad4b3d4f6d603be8ae4d92d

Quakbot

e022362a9fde5b81a08295892822bc21ece364fa7e1adef735ca1c9a7e50cd64

Quakbot

f1c1706d380fd2a149dc7bde40ee795a0ab3dc56aa665b13cbadd131a7aa2235

Quakbot

+ 1'337 additional samples on MalwareBazaar

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:snow01 campaign:1662453469 banker stealer trojan

Link:

https://tria.ge/reports/220908-pglzzseef7/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Qakbot/Qbot

Malware Config

C2 Extraction:

200.161.62.126:32101
217.165.68.122:993
99.232.140.205:2222
81.131.161.131:2078
89.211.179.14:2222
186.64.87.202:443
197.94.210.133:443
193.3.19.37:443
37.210.148.30:995
200.100.55.252:32101
70.51.153.182:2222
120.150.218.241:995
173.189.167.21:995
24.139.72.117:443
104.34.212.7:32103
47.23.89.61:995
24.55.67.176:443
172.115.177.204:2222
217.165.77.134:995
24.178.196.158:2222
67.209.195.198:443
111.125.245.116:995
39.49.67.4:995
78.101.202.75:50010
37.34.253.233:443
217.165.77.134:443
46.107.48.202:443
70.46.220.114:443
63.143.92.99:995
93.48.80.198:995
179.158.103.236:443
47.180.172.159:443
47.23.89.61:993
72.252.157.93:995
182.191.92.203:995
187.172.230.151:443
72.252.157.93:990
24.158.23.166:995
32.221.224.140:995
41.84.238.19:443
41.228.22.180:443
197.167.27.20:993
45.46.53.140:2222
47.156.129.52:443
148.64.96.100:443
63.143.92.99:443
173.21.10.71:2222
66.230.104.103:443
76.25.142.196:443
100.38.242.113:995
208.107.221.224:443
197.89.12.179:443
39.44.34.119:995
196.203.37.215:80
39.57.40.50:995
117.248.109.38:21
121.7.223.38:2222
85.104.122.231:443
118.172.249.102:443
1.161.70.129:443
39.52.28.146:995
188.136.218.20:61202
212.70.96.76:995
1.161.70.129:995
174.69.215.101:443
69.14.172.24:443
86.213.191.206:2078
176.45.233.14:995
82.41.63.217:443
67.69.166.79:2222
217.164.237.54:2222
217.164.121.130:1194
39.41.114.133:995
100.38.242.113:443
120.61.3.17:443
101.50.120.124:995
217.128.122.65:2222
217.128.122.65:443
88.227.46.238:443
223.229.136.61:443
72.252.157.93:993
76.185.151.214:443
2.34.12.8:443
157.51.47.233:50001

Unpacked files

SH256 hash:

0e86b00bf2b4072c0df1fde0a381e0db5d271cbc8fced105370c50487efcb4f4

MD5 hash:

7e6ce9b6b61f3e1f9fbc530d9965ce50

SHA1 hash:

06305075204904416a0311c28d768ebbb1b0fb4b

Link:

https://www.unpac.me/results/7b03cf16-d232-44c5-9818-eb8a43347a23/

SH256 hash:

23d77f1405b6abc69458d6953c8376650ffeca26f7f95ef32db9a58271fd2bd3

MD5 hash:

3e86ac10b4e7d818e0f410130bb7f237

SHA1 hash:

8977a9178b40819a53df36bc37be64f1b1ae1105

Detections:

win_qakbot_auto

Link:

https://www.unpac.me/results/7b03cf16-d232-44c5-9818-eb8a43347a23/

Parent samples :

4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14
73e9c07b6422fb135f06e0660b24a08be7d5bfe5b77d2b9f0096f8d03af52876
e0accb4407df08ec103be2d05017a3f3b37459c0784f9feb4eaf50122bfcd80e

SH256 hash:

4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14

MD5 hash:

da51dd657868bf4d2924b4398e045b27

SHA1 hash:

2eca78e78bdc00e02da0a7328a3c57176cf3c011

Link:

https://www.unpac.me/results/7b03cf16-d232-44c5-9818-eb8a43347a23/

Malware family:

QBot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4f13d35180b8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4f13d35180b85261aa49bd280ae52c6ff501fcc224ecd8ff729697337e14ce14

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com