MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d8ef65670101ecf342152a34ae4b17784186759686c0e5eb631a9fa47315647. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 10


Intelligence 10 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d8ef65670101ecf342152a34ae4b17784186759686c0e5eb631a9fa47315647
SHA3-384 hash: 1d94a510cb86d7eea067d39d883287a09f48c5ed56b355c0878aaded535c524575861d8cec705526f862962ab6f7c99a
SHA1 hash: e28186bc0d771d20527b5f80757f4ee3f0ce442e
MD5 hash: 726a41b2959768c5c3d2c7c213e6d0d8
humanhash: west-mirror-winner-princess
File name:1.dll
Download: download sample
Signature Quakbot
Create hunting rule
File size:733'696 bytes
First seen:2022-04-12 17:19:46 UTC
Last seen:2022-04-12 17:57:22 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 1d26835eb92a34541e9e0eeabdddd35f (1 x Quakbot)
ssdeep 12288:wwwqgbwISL17CL+cZjXA8vl3QloyPu1WE8zdDF26pOmXAjMqXQ9DSFyOwRS82B15:DQbfSL1+icZkYl3QZGAE8zdx26pOmXED
Threatray 450 similar samples on MalwareBazaar
TLSH T14FF4BFB875047CD6E1AF467BDE96ACDD13B6177289CB99CD80647BC309A3362EE02C05
Reporter pr0xylife
Tags:AA dll Qakbot Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
320
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/263200/
Detection(s):
SecuriteInfo.com.Variant.Lazy.161161.24610.20391.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Creating a window
Creating a file in the system32 subdirectories
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
packed qbot
Link:
https://www.filescan.io/uploads/6255b4c4482f2f41caa12ea4/reports/a7f65b53-ea6d-4be3-aa10-e0bb8e199d73/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/05ad884d-631f-4529-8571-3d6eb251ffb5
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/975631
Signature
Allocates memory in foreign processes
Found malware configuration
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Suspicious Call by Ordinal
Writes to foreign memory regions
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 608120 Sample: 1.dll Startdate: 12/04/2022 Architecture: WINDOWS Score: 88 35 Found malware configuration 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected Qbot 2->39 41 Sigma detected: Suspicious Call by Ordinal 2->41 8 loaddll32.exe 1 2->8         started        process3 signatures4 43 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->43 45 Injects code into the Windows Explorer (explorer.exe) 8->45 47 Writes to foreign memory regions 8->47 49 2 other signatures 8->49 11 regsvr32.exe 8->11         started        14 rundll32.exe 8->14         started        16 cmd.exe 1 8->16         started        18 3 other processes 8->18 process5 signatures6 51 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 11->51 53 Injects code into the Windows Explorer (explorer.exe) 11->53 55 Writes to foreign memory regions 11->55 57 2 other signatures 11->57 20 explorer.exe 8 1 11->20         started        22 WerFault.exe 23 9 14->22         started        25 rundll32.exe 16->25         started        27 WerFault.exe 9 18->27         started        29 WerFault.exe 2 9 18->29         started        process7 dnsIp8 33 192.168.2.1 unknown unknown 22->33 31 WerFault.exe 9 25->31         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d8ef65670101ecf342152a34ae4b17784186759686c0e5eb631a9fa47315647/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-04-12 17:20:08 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
16 of 42 (38.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nwhpmvtqcapm6nbbkkruvzfro6cbqz2znbwa4xvwggu7urzrkzdq._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
1cdad75e7830e4ae946bb26c15be354676820710c2471d9ea6d24926fc0df86f
Quakbot
73f5c306c33c980fcd85f185af9c2a2b7678eebda5b10ec072558bd74dd776af
Quakbot
80d48eb263fe58d5a0afaa20679c5824c9f5fdce8a6707e5c9ef3c8817011938
Quakbot
b111a710a0a9f11092e94035e9609266d1a69b4aa7031c6d67528ee106d36216
Quakbot
c0beb47f629a5debe0e99790d16a4d04afe786d6fb42c5ab6dfcaed84d86e7ad
Quakbot
df8d431b3d7193b0d0d6667b269ef1b2431086343bf86a41c3a2a2488d9f1567
Quakbot
f2f87129d1786fd86f0ec659457aae0e186c023a19f63d207c17b28dc63ae2e9
Quakbot
f6e7187a8e0aa202fe89008b5a5cc5e99dc5c3aaede7213283cae41dc7cb3ebc
Quakbot
+ 440 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:aa campaign:1649749884 banker stealer trojan
Link:
https://tria.ge/reports/220412-vwegcahdc2/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
120.150.218.241:995
186.64.67.38:443
196.203.37.215:80
1.161.71.109:443
82.152.39.39:443
76.69.155.202:2222
72.66.116.235:995
103.107.113.120:443
113.11.89.165:995
208.107.221.224:443
103.88.226.30:443
75.99.168.194:443
75.113.214.234:2222
76.169.147.192:32103
190.73.3.148:2222
39.52.2.90:995
38.70.253.226:2222
5.95.58.211:2087
74.15.2.252:2222
76.70.9.169:2222
121.74.167.191:995
197.167.62.14:993
108.60.213.141:443
47.23.89.62:993
86.97.247.20:2222
47.23.89.62:995
176.67.56.94:443
86.98.33.251:443
96.37.113.36:993
148.64.96.100:443
47.180.172.159:443
140.82.49.12:443
80.11.74.81:2222
96.21.251.127:2222
177.158.7.155:443
125.168.47.127:2222
41.228.22.180:443
181.208.248.227:443
81.215.196.174:443
105.226.83.196:995
176.88.238.122:995
46.107.48.202:443
24.43.99.75:443
172.115.177.204:2222
180.129.102.214:995
2.50.137.197:443
78.87.206.213:995
72.76.94.99:443
66.98.42.102:443
109.228.220.196:443
75.99.168.194:61201
71.13.93.154:2222
45.9.20.200:443
173.174.216.62:443
31.35.28.29:443
93.48.80.198:995
32.221.224.140:995
203.122.46.130:443
47.180.172.159:50010
187.207.48.194:61202
39.44.144.159:995
92.132.172.197:2222
176.205.119.81:2078
144.202.2.175:995
45.76.167.26:995
149.28.238.199:995
45.76.167.26:443
144.202.2.175:443
144.202.3.39:995
45.63.1.12:995
140.82.63.183:995
144.202.3.39:443
149.28.238.199:443
45.63.1.12:443
140.82.63.183:443
63.143.92.99:995
70.46.220.114:443
103.87.95.133:2222
1.161.71.109:995
117.248.109.38:21
180.183.97.165:2222
86.97.11.43:443
202.134.152.2:2222
39.57.23.116:995
91.177.173.10:995
217.128.122.65:2222
24.178.196.158:2222
37.210.164.171:2222
37.186.54.254:995
86.98.208.214:2222
83.110.75.225:2222
174.69.215.101:443
217.165.147.83:993
172.114.160.81:995
84.241.8.23:32103
111.125.245.118:995
173.21.10.71:2222
182.191.92.203:995
191.99.191.28:443
73.151.236.31:443
119.158.121.244:995
71.74.12.34:443
101.50.103.193:995
47.158.25.67:443
187.172.232.250:443
47.156.191.217:443
187.250.114.15:443
187.195.19.24:443
201.145.189.252:443
72.252.201.34:990
72.252.201.34:995
45.46.53.140:2222
190.252.242.69:443
187.251.132.144:22
181.62.0.59:443
72.12.115.90:22
103.246.242.202:443
100.1.108.246:443
191.17.223.222:32101
40.134.246.185:995
24.55.67.176:443
109.12.111.14:443
90.120.65.153:2078
179.158.105.44:443
72.252.201.34:993
201.103.199.197:443
37.34.253.233:443
70.51.138.126:2222
187.102.135.142:2222
187.52.231.156:443
86.97.247.20:1194
41.84.242.5:995
186.105.121.166:443
31.48.166.122:2078
89.137.52.44:443
96.29.208.97:443
85.74.48.5:995
197.205.101.36:443
102.182.232.3:995
86.195.158.178:2222
217.164.210.192:443
197.89.8.167:443
201.211.64.196:2222
45.241.202.203:995
175.145.235.37:443
86.98.33.141:995
85.246.82.244:443
43.252.72.97:2222
67.209.195.198:990
41.38.167.179:995
Unpacked files
SH256 hash:
6d8ef65670101ecf342152a34ae4b17784186759686c0e5eb631a9fa47315647
MD5 hash:
726a41b2959768c5c3d2c7c213e6d0d8
SHA1 hash:
e28186bc0d771d20527b5f80757f4ee3f0ce442e
Link:
https://www.unpac.me/results/a01d9162-0c5f-4bc5-8a90-8db0304b3ff0/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/6d8ef6567010/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/263200/

Comments