MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f1fa4e10f6e48c0a9a818f06f09955f2aeec7fe8b25708d5f5b0d1b8e8ec63c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	4f1fa4e10f6e48c0a9a818f06f09955f2aeec7fe8b25708d5f5b0d1b8e8ec63c
SHA3-384 hash:	34296899be665392f68255fe13df9aee7668cbb3f9c84039c189af290f5705df46835804113fd5a26bf82e061cc7ebbc
SHA1 hash:	79c2a58eeab8aeeb53e9d4f37b78826b4fb62383
MD5 hash:	137a73c7616a191b8941c8d96108879a
humanhash:	yankee-finch-pennsylvania-uranus
File name:	1412.exe
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	2'291'200 bytes
First seen:	2020-12-15 15:33:23 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	ecca4ffd089c440aee3586c7d44e5f61 (2 x Quakbot)
ssdeep	24576:xeRYe2+Uj9QNHvbyVfbWWbyHjaSabybbybvkblebR:xeRL49gEk
Threatray	1 similar samples on MalwareBazaar
TLSH	90B59BDD0974427FE08C39F90C179BE5AE0FEBD9524E50EE89E36624815EAF7801A533
Reporter	Anonymous
Tags:	exe Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

176

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/108179/

Detection(s):

SecuriteInfo.com.Trojan.Inject4.6242.30265.20263.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the Windows subdirectories

Launching a process

Modifying an executable file

Creating a process with a hidden window

Creating a window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Unknown

Detection:

malicious

Classification:

n/a

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/563373

Signature

Machine Learning detection for sample

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4f1fa4e10f6e48c0a9a818f06f09955f2aeec7fe8b25708d5f5b0d1b8e8ec63c/

Threat name:

Win32.Trojan.QBot

Status:

Malicious

First seen:

2020-12-15 15:34:05 UTC

AV detection:

17 of 28 (60.71%)

Threat level:

5/5

Verdict:

suspicious

Quakbot

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:tr02 campaign:1608026105 banker stealer trojan

Link:

https://tria.ge/reports/201215-s19s4ct94j/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Program crash

Loads dropped DLL

Qakbot/Qbot

Malware Config

C2 Extraction:

111.95.212.237:2222
190.220.8.10:995
109.154.79.222:2222
83.110.250.71:995
149.28.99.97:2222
45.63.107.192:443
149.28.101.90:2222
149.28.101.90:995
149.28.99.97:443
149.28.98.196:443
144.202.38.185:2222
45.77.115.208:995
149.28.98.196:2222
149.28.98.196:995
149.28.99.97:995
45.63.107.192:2222
144.202.38.185:995
144.202.38.185:443
45.63.107.192:995
5.13.84.186:995
68.83.89.188:443
67.141.11.98:443
219.76.148.249:443
86.245.82.249:2078
116.240.78.45:995
37.182.244.124:2222
72.186.1.237:443
78.97.207.104:443
80.14.22.234:2222
202.141.225.158:443
72.28.255.159:995
37.6.208.105:2222
161.142.217.62:443
188.253.85.49:995
217.165.3.30:443
90.61.38.208:2222
2.49.219.254:22
124.29.232.108:443
2.50.143.154:2222
2.50.2.216:443
197.161.154.132:443
103.76.160.110:443
51.223.138.251:443
102.185.13.89:443
85.101.187.146:443
92.154.83.96:2087
45.118.216.157:443
86.122.248.164:2222
92.154.83.96:1194
217.165.125.217:443
92.154.83.96:2078
85.105.29.218:443
151.60.38.21:443
156.213.217.254:443
2.50.57.224:443
217.162.149.212:443
182.161.6.57:3389
24.27.82.216:2222
37.166.181.234:0
45.77.115.208:2222
203.106.116.190:443
85.52.72.32:2222
2.51.240.250:995
2.91.9.248:443
101.109.175.33:443
41.228.47.147:443
78.101.199.138:995
125.63.101.62:443
90.53.103.26:2222
86.124.93.144:443
79.114.177.162:993
5.2.212.254:443
86.127.22.190:443
81.133.234.36:2222
5.15.109.245:443
37.130.115.124:443
2.50.88.125:995
62.38.114.12:2222
78.181.19.134:443
187.155.59.73:443
102.187.95.88:443
79.129.216.215:2222
141.237.135.194:443
42.117.61.10:443
93.148.241.179:2222
41.205.16.222:443
46.53.2.70:443
151.61.125.180:2222
151.73.121.136:443
176.181.247.197:443
149.28.101.90:8443
2.7.69.217:2222
84.117.176.32:443
109.205.204.229:2222
184.179.14.130:22
203.106.195.67:443
121.58.199.24:443
216.201.162.158:443
83.110.13.182:2222
172.87.157.235:3389
45.118.65.34:443
79.129.252.62:2222
2.50.30.147:995
2.50.159.104:2222
105.198.236.101:443
78.96.199.79:443
217.133.54.140:32100
172.91.19.192:443
196.204.207.111:443
77.132.113.187:2222
185.163.221.77:2222
197.49.240.8:995
45.77.115.208:8443
108.30.125.94:443
213.60.147.140:443
217.165.9.48:443
94.70.36.227:2222
59.99.36.20:443
104.37.20.207:995
5.193.106.230:2078
117.215.198.5:443
2.50.49.18:22
2.88.1.76:995
66.25.168.167:2222
173.21.10.71:2222
106.250.150.98:443
58.152.9.133:443
72.36.59.46:2222
89.137.211.239:995
96.241.66.126:443
93.86.1.159:995
95.76.27.6:443
217.128.117.218:2222
37.211.23.45:995
120.150.34.178:443
86.120.138.232:443
41.97.125.168:443
87.27.110.90:2222
82.76.47.211:443
94.69.242.254:2222
90.101.62.189:2222
78.187.125.116:2222
197.57.96.163:443
197.90.131.100:32100
5.193.178.36:2078
196.151.252.84:443
118.100.159.27:443
105.198.236.99:443
185.105.131.233:443
45.77.115.208:443