MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fe1e3a80e09c71e09971367027d8cd12c8a2826123d8e1d65a639532d1ed5b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	5fe1e3a80e09c71e09971367027d8cd12c8a2826123d8e1d65a639532d1ed5b4
SHA3-384 hash:	3eb01e2d21c5ac9d64467be1232e01a7b09a0395343b7a63c157b372ad060c37f9500d80553efb91348df63e5738e846
SHA1 hash:	cd6be09564ed8470f4ab2b915ae27baf95e6639a
MD5 hash:	c027d996125dd5cd9ca955427b9b5ed8
humanhash:	comet-six-berlin-xray
File name:	8888888.png2.exe
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	788'992 bytes
First seen:	2020-05-26 08:37:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	e5bc74f731ea8626c5c455b44885e2a9 (11 x Quakbot)
ssdeep	6144:Jfyiw/aswLvWua+t2gqIpcSuPtlklAghAWD2PNEtd3fBHeg487ebFPyL2tvJf:1yiwCsyvVaFgq6LuM+0D2PNEtdYy6tJ
Threatray	420 similar samples on MalwareBazaar
TLSH	17F49B06256F5F2AFFC63236DDADF865A712FB0E173BA0763C1470A9B0926964534F02
Reporter	oppimaniac
Tags:	Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Threat name:

Win32.Trojan.Qbot

Status:

Malicious

First seen:

2020-05-26 09:36:55 UTC

File Type:

PE (Exe)

AV detection:

34 of 48 (70.83%)

Threat level:

5/5

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:spx124 campaign:1590052330 banker cryptone evasion packer stealer trojan

Link:

https://tria.ge/reports/201109-f1v1v8jm9e/

Behaviour

Creates scheduled task(s)

Modifies data under HKEY_USERS

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Loads dropped DLL

Executes dropped EXE

CryptOne packer

Qakbot/Qbot

Turns off Windows Defender SpyNet reporting

Windows security bypass

Malware Config

C2 Extraction:

188.173.185.139:443
117.241.53.130:443
81.103.144.77:443
217.219.50.172:990
103.76.160.110:443
68.204.164.222:443
98.32.60.217:443
173.245.152.231:443
72.240.245.253:443
112.171.126.153:443
141.85.114.172:443
31.5.189.71:443
71.77.231.251:443
72.190.101.70:443
140.82.21.191:443
31.5.41.52:443
78.188.109.130:443
70.124.29.226:443
24.43.22.220:993
101.108.114.66:443
137.103.143.124:443
203.213.104.25:995
182.56.134.44:995
24.201.79.208:2078
24.110.96.149:443
98.222.23.221:443
50.104.186.71:443
67.83.54.76:2222
104.36.135.227:443
68.1.171.93:443
24.43.22.220:995
75.183.171.155:3389
47.41.3.40:443
68.98.142.248:995
81.133.234.36:2222
98.121.187.78:443
47.205.231.60:443
66.26.160.37:443
69.92.54.95:995
67.209.195.198:3389
41.228.231.93:443
184.98.104.7:995
72.204.242.138:6881
210.61.141.92:443
35.142.12.163:2222
24.46.40.189:2222
96.56.237.174:993
189.231.179.154:443
98.115.138.61:443
50.29.166.232:995
173.79.220.156:443
70.174.3.241:443
47.146.169.85:443
50.29.181.193:995
216.110.249.252:2222
76.117.227.153:443
98.118.156.172:443
70.173.46.139:443
79.114.195.15:443
75.110.250.89:443
50.96.232.242:995
203.106.194.13:443
47.232.26.181:443
47.180.66.10:443
71.8.33.238:443
71.241.247.189:443
71.80.66.107:443
207.255.161.8:2222
173.173.68.41:443
116.202.36.62:21
68.46.142.48:443
100.40.48.96:443
47.136.224.60:443
98.173.34.212:995
197.37.177.211:993
185.145.113.249:443
95.77.223.148:443
72.204.242.138:20
68.60.221.169:465
72.204.242.138:2087
72.69.180.183:61202
68.4.137.211:443
72.204.242.138:53
59.124.10.133:443
171.97.10.201:2222
188.214.99.182:995
102.190.173.155:6881
108.58.9.238:443
188.173.214.88:443
66.76.255.133:2078
41.129.128.231:443
5.15.237.243:443
50.244.112.10:443
72.204.242.138:443
72.204.242.138:2078
72.204.242.138:990
102.41.118.44:995
47.153.115.154:443
68.149.64.58:2222
207.255.161.8:995
207.255.161.8:2078
73.76.47.127:443
76.187.97.98:2222
5.14.251.226:443
65.116.179.83:443
96.35.170.82:2222
84.117.60.157:443
108.58.9.238:993
207.255.161.8:2087
142.129.227.86:443
37.8.32.154:443
24.96.22.21:443
207.255.161.8:32102
1.40.42.4:443
108.58.9.238:995
74.33.69.208:443
66.222.88.126:995
47.152.210.233:443
24.99.180.247:443
50.244.112.106:443
172.242.156.50:443
67.131.59.17:443
24.10.42.174:443
190.198.125.194:2078
49.191.9.180:995
41.96.210.164:443
50.247.230.33:995
76.170.77.99:443
70.183.127.6:995
66.68.22.151:443
97.127.144.203:2222
137.99.224.198:443
209.182.121.133:2222
50.78.93.74:443
72.204.242.138:50003
79.101.206.85:995
24.122.228.88:443
24.213.191.38:0
50.246.229.50:443
203.33.139.134:443
75.137.60.81:443
207.255.161.8:443
24.229.245.124:995
24.43.22.220:443
172.78.87.180:443
67.0.73.239:443
79.116.237.126:443
47.155.19.205:443
75.81.25.223:443
31.5.21.66:443

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	win_qakbot_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample