MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59b1c54f0a9ecc48d6f2c567c4344411cde31ece7a1759b84cb84a8484792c13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	59b1c54f0a9ecc48d6f2c567c4344411cde31ece7a1759b84cb84a8484792c13
SHA3-384 hash:	ebf4b7a4730b454370772ea576890067983e006fdf23d035060fc6aca3dcc45c903d8fdddc32f10222130538559168f7
SHA1 hash:	fbf0234be80754c2794dc7f758c19b29ecad10d8
MD5 hash:	fb8ded4c032dd60a070b095fd5c0386d
humanhash:	king-cat-king-wisconsin
File name:	fb8ded4c032dd60a070b095fd5c0386d.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	938'496 bytes
First seen:	2021-03-01 19:09:56 UTC
Last seen:	2021-03-01 20:36:40 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	19b66339a5a263775245e475e813340d (2 x Quakbot)
ssdeep	12288:cxL4guDPg+PlrIHY5uaexaekHEc+2CxLxzU59v2LxzzQUBrKSTkWtscd:IsV9PlrIHYsxaedJdzGgLjt
Threatray	205 similar samples on MalwareBazaar
TLSH	90158F22B292C433C1732B3C9D3762A89C6FBE013D28654A7BE41E4C5F3964275763A7
Reporter	abuse_ch
Tags:	biden02 dll Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

364

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/120388/

Detection(s):

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the Windows subdirectories

Launching a process

Modifying an executable file

Creating a process with a hidden window

Sending a UDP request

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/59b1c54f0a9ecc48d6f2c567c4344411cde31ece7a1759b84cb84a8484792c13/

Threat name:

Win32.Trojan.Bsymem

Status:

Malicious

First seen:

2021-03-01 19:10:08 UTC

AV detection:

19 of 29 (65.52%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lgy4ktykt3gervxsyvt4incechg6ghwopilvtocmxbfijbdzfqjq._file

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:biden02 campaign:1614254614 banker stealer trojan

Link:

https://tria.ge/reports/210301-xsgp7rlmps/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Loads dropped DLL

Qakbot/Qbot

Malware Config

C2 Extraction:

71.163.223.159:443
83.110.9.71:2222
87.202.87.210:2222
47.22.148.6:443
78.180.179.136:443
67.8.103.21:443
140.82.49.12:443
213.60.147.140:443
187.250.39.162:443
86.236.77.68:2222
108.46.145.30:443
172.87.157.235:3389
79.115.174.55:443
217.133.54.140:32100
83.110.109.106:2222
78.63.226.32:443
83.196.56.65:2222
59.90.246.200:443
89.137.211.239:995
105.96.8.96:443
125.209.114.182:995
106.51.85.162:443
73.153.211.227:443
105.198.236.99:443
45.63.107.192:2222
149.28.101.90:995
149.28.99.97:995
45.63.107.192:995
207.246.77.75:443
207.246.77.75:2222
149.28.99.97:443
149.28.99.97:2222
45.32.211.207:443
45.32.211.207:995
45.32.211.207:8443
45.32.211.207:2222
45.63.107.192:443
149.28.98.196:2222
149.28.98.196:995
149.28.98.196:443
144.202.38.185:443
144.202.38.185:2222
144.202.38.185:995
149.28.101.90:443
149.28.101.90:8443
149.28.101.90:2222
45.77.115.208:8443
45.77.115.208:443
45.77.115.208:995
45.77.115.208:2222
207.246.77.75:995
207.246.77.75:8443
207.246.116.237:443
207.246.116.237:995
207.246.116.237:8443
207.246.116.237:2222
45.77.117.108:443
45.77.117.108:8443
45.77.117.108:995
45.77.117.108:2222
80.227.5.69:443
219.76.148.200:443
197.51.82.72:443
193.248.221.184:2222
84.72.35.226:443
2.232.253.79:995
24.43.22.218:993
81.97.154.100:443
90.65.236.181:2222
95.77.223.148:443
83.110.103.152:443
119.153.43.235:3389
89.3.198.238:443
98.192.185.86:443
115.133.243.6:443
2.7.116.188:2222
188.26.91.212:443
113.22.175.141:443
176.181.247.197:443
173.21.10.71:2222
45.46.53.140:2222
50.29.166.232:995
96.37.113.36:993
202.188.138.162:443
76.25.142.196:443
65.27.228.247:443
122.148.156.131:995
71.74.12.34:443
142.117.191.18:2222
202.184.20.119:443
98.252.118.134:443
189.211.177.183:995
189.222.59.177:443
74.68.144.202:443
189.146.183.105:443
71.197.126.250:443
32.210.98.6:443
187.250.118.233:995
92.59.35.196:2222
195.12.154.8:443
67.6.12.4:443
86.160.137.132:443
96.57.188.174:2222
38.92.225.121:443
197.45.110.165:995
181.48.190.78:443
173.184.119.153:995
24.229.150.54:995
50.244.112.106:443
144.139.166.18:443
81.150.181.168:2222
68.186.192.69:443
74.222.204.82:995
71.117.132.169:443
98.121.187.78:443
75.136.26.147:443
85.52.72.32:2222
109.12.111.14:443
80.11.173.82:8443
209.210.187.52:443
209.210.187.52:995
108.160.123.244:443
24.152.219.253:995
196.151.252.84:443
172.115.177.204:2222
24.139.72.117:443
24.55.112.61:443
105.198.236.101:443
186.28.55.211:443
97.69.160.4:2222
47.187.108.172:443
216.201.162.158:443
71.199.192.62:443
71.88.193.17:443
71.187.170.235:443
77.211.30.202:995
77.27.204.204:995
189.210.115.207:443
125.239.152.76:995
82.12.157.95:995
98.173.34.213:995
151.205.102.42:443
72.240.200.181:2222
160.3.187.114:443
73.25.124.140:2222
24.50.118.93:443
82.127.125.209:990
79.129.121.81:995
189.223.234.23:995
108.31.15.10:995

Unpacked files

SH256 hash:

db99902dd3d4f5c681f4b983aaf04204d50bb82a891e68d364a7806edfaa60cf

MD5 hash:

09c8e9305c681394fc1603be976f3642

SHA1 hash:

9381fbb5fb05a82ee1fc32a59b053fc200e2eb76

Link:

https://www.unpac.me/results/81fb3637-fd23-42d8-8e7f-fe6b9016de8e/

SH256 hash:

59b1c54f0a9ecc48d6f2c567c4344411cde31ece7a1759b84cb84a8484792c13

MD5 hash:

fb8ded4c032dd60a070b095fd5c0386d

SHA1 hash:

fbf0234be80754c2794dc7f758c19b29ecad10d8

Link:

https://www.unpac.me/results/81fb3637-fd23-42d8-8e7f-fe6b9016de8e/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/59b1c54f0a9ecc48d6f2c567c4344411cde31ece7a1759b84cb84a8484792c13

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QakBot Create hunting rule
Author:	kevoreilly
Description:	QakBot Payload

Rule name:	qbot_bin Create hunting rule
Author:	James_inthe_box
Description:	Qbot Qakbot
Reference:	https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02