MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cf53416d2eb8d1ae622a299a239046f6bfae9be7d56083e8feb602863fed6fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	6cf53416d2eb8d1ae622a299a239046f6bfae9be7d56083e8feb602863fed6fb
SHA3-384 hash:	0d6d83b11eccbf0fb8b3c3ef570323ba1069414989a6a777825868ef57bef9ba6c7c823ca2a39c0d5e29bc3ce5044cbb
SHA1 hash:	4c7a6a01b93df2bc1e61fffcedef08e5c10c3bfe
MD5 hash:	a2bd90db4e6cfe9d6ab7c435edab35c1
humanhash:	beryllium-avocado-tennessee-nineteen
File name:	a2bd90db4e6cfe9d6ab7c435edab35c1.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	305'600 bytes
First seen:	2021-02-03 18:34:35 UTC
Last seen:	2021-02-04 08:04:29 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	5a9f8697ac3858ea5a90a2d4f246b70c (15 x Quakbot)
ssdeep	6144:RMLWCfv+q6D1NaWF88siwzYiPU8PDUuaL3hr:R8WCfv+f1NaH9ZzYbAUbV
Threatray	89 similar samples on MalwareBazaar
TLSH	7354E123B291C836E762EE788F0AB315D4BBBC113D36144AE2D54B0D4D7D5A06F486DB
Reporter	abuse_ch
Tags:	dll Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

278

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/115415/

Detection(s):

PUA.Win.Packer.Pequake-4

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

SecuriteInfo.com.BackDoor.Qbot.582.11353.14934.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the Windows subdirectories

Launching a process

Modifying an executable file

Sending a UDP request

Creating a process with a hidden window

Creating a window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6cf53416d2eb8d1ae622a299a239046f6bfae9be7d56083e8feb602863fed6fb/

Threat name:

Win32.Trojan.QBot

Status:

Malicious

First seen:

2021-02-03 18:35:06 UTC

File Type:

PE (Dll)

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nt2tifws5ogrvzrcukm2eoien5v7v2n6pvlaqpup5nqcqy76235q._file

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:abc123 campaign:1612349986 banker stealer trojan

Link:

https://tria.ge/reports/210203-weqnefzgkx/

Behaviour

Checks SCSI registry key(s)

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Qakbot/Qbot

Malware Config

C2 Extraction:

222.154.253.111:995
50.244.112.106:443
83.110.108.181:2222
105.198.236.99:443
74.77.162.33:443
106.250.150.98:443
196.151.252.84:443
45.118.216.157:443
140.82.49.12:443
80.11.173.82:8443
71.88.193.17:443
68.186.192.69:443
46.153.119.255:995
81.214.126.173:2222
108.31.15.10:995
197.45.110.165:995
81.88.254.62:443
86.97.8.249:443
202.187.58.21:443
41.39.134.183:443
80.227.5.69:443
105.186.102.16:443
125.63.101.62:443
68.225.60.77:995
188.25.63.105:443
216.201.162.158:443
82.76.47.211:443
71.187.170.235:443
144.139.47.206:443
96.21.251.127:2222
203.194.110.74:443
171.103.138.122:995
193.248.221.184:2222
81.97.154.100:443
151.60.14.100:443
79.129.121.81:995
37.211.90.175:995
75.136.40.155:443
86.220.60.133:2222
203.198.96.37:443
160.3.187.114:443
47.22.148.6:443
176.181.247.197:443
77.31.46.230:443
82.127.125.209:990
197.35.9.48:443
202.188.138.162:443
60.49.104.167:443
81.150.181.168:2222
172.78.30.215:443
83.110.103.152:443
45.77.115.208:2222
78.63.226.32:443
90.101.117.122:2222
2.50.2.216:443
68.131.107.37:443
75.67.192.125:443
85.52.72.32:2222
76.110.113.71:995
106.51.52.111:443
209.210.187.52:443
154.125.89.244:995
84.72.35.226:443
172.115.177.204:2222
86.98.93.124:2078
45.32.211.207:2222
45.32.211.207:995
207.246.116.237:443
144.202.38.185:443
45.63.107.192:443
149.28.99.97:443
149.28.99.97:2222
149.28.99.97:995
149.28.101.90:443
149.28.101.90:995
149.28.101.90:2222
45.63.107.192:995
207.246.77.75:2222
144.202.38.185:2222
45.32.211.207:8443
144.202.38.185:995
45.32.211.207:443
149.28.98.196:2222
207.246.116.237:8443
207.246.77.75:443
207.246.77.75:8443
207.246.116.237:2222
207.246.116.237:995
149.28.98.196:995
45.63.107.192:2222
149.28.98.196:443
149.28.101.90:8443
45.77.115.208:443
207.246.77.75:995
77.27.174.49:995
92.59.35.196:2222
98.121.187.78:443
184.189.122.72:443
109.106.69.138:2222
175.141.219.71:443
45.77.115.208:8443
45.77.115.208:995
172.87.157.235:3389
184.179.14.130:22
190.85.91.154:443
83.110.12.140:2222
85.58.200.50:2222
151.242.43.85:32103
176.205.222.30:2222
202.184.20.119:443
84.247.55.190:8443
2.232.253.79:995
213.60.147.140:443
24.50.118.93:443
64.121.114.87:443
85.132.36.111:2222
70.126.76.75:443
105.198.236.101:443
89.137.211.239:995
95.77.223.148:443
86.236.77.68:2222
115.133.243.6:443
197.161.154.132:443
45.46.53.140:2222
82.12.157.95:995
27.223.92.142:995
209.210.187.52:995
139.216.137.189:995
31.5.21.66:995
76.25.142.196:443
173.21.10.71:2222
50.29.166.232:995
94.53.92.42:443
75.118.1.141:443
50.240.77.238:22
71.74.12.34:443
75.136.26.147:443
144.139.166.18:443
37.211.83.41:443
67.6.12.4:443
184.103.117.178:443
24.253.38.139:993
122.148.156.131:995
69.123.179.70:443
125.239.152.76:995
71.197.126.250:443
98.207.89.76:2222
100.2.123.122:443
98.240.24.57:443
186.28.51.27:443

Unpacked files

SH256 hash:

265d522b9537e44f6dd96f80bfc30f1964675033bb7503557d6566f9cc0b047d

MD5 hash:

39fc60b24b6b002aa19e7b17e57badbd

SHA1 hash:

49a9c9bc6a2913e75626bfaf7739d00c8a195d05

Link:

https://www.unpac.me/results/08121b27-6420-4038-9acf-25b502092a66/

SH256 hash:

6cf53416d2eb8d1ae622a299a239046f6bfae9be7d56083e8feb602863fed6fb

MD5 hash:

a2bd90db4e6cfe9d6ab7c435edab35c1

SHA1 hash:

4c7a6a01b93df2bc1e61fffcedef08e5c10c3bfe

Link:

https://www.unpac.me/results/08121b27-6420-4038-9acf-25b502092a66/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6cf53416d2eb8d1ae622a299a239046f6bfae9be7d56083e8feb602863fed6fb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QakBot Create hunting rule
Author:	kevoreilly
Description:	QakBot Payload

Rule name:	qbot_bin Create hunting rule
Author:	James_inthe_box
Description:	Qbot Qakbot
Reference:	https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02