MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e7c6b22cb9ae14cb1df2f30bd6984dd7d7c042316540aa86a86f0cb2adfdc46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e7c6b22cb9ae14cb1df2f30bd6984dd7d7c042316540aa86a86f0cb2adfdc46
SHA3-384 hash: 59d6fd406072f24df98b8ce6bb9f26c70be76a8ae3c6aa40b8bbfd34e663870711f0a37649290c508eb15a8235a03824
SHA1 hash: 54c0c105f79c5c265ed150e7bf74e807e8ef2807
MD5 hash: 24099dc2503020948f9c74184d0c1c41
humanhash: oregon-yankee-single-red
File name:maastricht.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:745'472 bytes
First seen:2022-10-25 13:48:08 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash d833407db486106e47f28b98cbd678b4 (2 x Quakbot)
ssdeep 12288:9Zvx07iKfDISZYRobaZ0UrIBfUQ0eIYM4WV6nwldJOCPrHuD5:9ta1DjZBBAgd1M4F6dMCjHu
Threatray 1'575 similar samples on MalwareBazaar
TLSH T11AF4AF32F1E8C433D1362AB89D3756A59C6BBD012D28AC4A6FE50F4D4F35A8136252F7
TrID 47.6% (.EXE) Win32 Executable Delphi generic (14182/79/4)
15.1% (.EXE) Win32 Executable (generic) (4505/5/1)
10.0% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
6.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter pr0xylife
Tags:dll Obama216 Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
295
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/324053/
Detection(s):
SecuriteInfo.com.Variant.Tedy.220972.20430.31157.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a window
Searching for synchronization primitives
Launching a process
Modifying an executable file
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/89b577ca-642a-444c-8753-205123da67ac
Result
Threat name:
CryptOne, Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1097626
Signature
Allocates memory in foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Execute DLL with spoofed extension
Writes to foreign memory regions
Yara detected CryptOne packer
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 730282 Sample: maastricht.dat.dll Startdate: 25/10/2022 Architecture: WINDOWS Score: 84 24 Yara detected CryptOne packer 2->24 26 Yara detected Qbot 2->26 28 Sigma detected: Execute DLL with spoofed extension 2->28 30 Machine Learning detection for sample 2->30 8 loaddll32.exe 1 2->8         started        process3 signatures4 32 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->32 34 Writes to foreign memory regions 8->34 36 Allocates memory in foreign processes 8->36 38 Maps a DLL or memory area into another process 8->38 11 wermgr.exe 8 1 8->11         started        14 cmd.exe 1 8->14         started        16 conhost.exe 8->16         started        process5 file6 22 C:\Users\user\Desktop\maastricht.dat.dll, PE32 11->22 dropped 18 rundll32.exe 14->18         started        process7 process8 20 WerFault.exe 23 9 18->20         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e7c6b22cb9ae14cb1df2f30bd6984dd7d7c042316540aa86a86f0cb2adfdc46/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-10-25 14:10:15 UTC
File Type:
PE (Dll)
Extracted files:
38
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nz6gwiwltlquzmo7f4yl22me3v6xybbdczkavkdkq3ymwkw73rda._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
0ec25b0db6bd1466458d898121de430e110ff3bcb870afac634240de027ab43a
Quakbot
290634e84d2e79107f8abf4b6943c6e900fc7efda85f3a1e83a9ac420d160d75
Quakbot
4df936e24707cbb9332c99488a20f5fa0f9e0ac5cc3a2ea4d509f3539ea79200
Quakbot
5c1eb12dc76bcbb34ad726ffb072076a24a1b5205ce81d3bf8b8b1ee268da336
Quakbot
97bb01022eaa46e69d39cbddd770c5d5312b806d0b94836f96d026db1d54bf03
Quakbot
c729f364bc952590a87aa014b4e4289716ca0f2b8be27965194ce58d174087f2
Quakbot
+ 1'565 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama216 campaign:1666689942 banker stealer trojan
Link:
https://tria.ge/reports/221025-q4n9aschen/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Program crash
Qakbot/Qbot
Malware Config
C2 Extraction:
24.116.45.121:443
24.206.27.39:443
71.199.168.185:443
70.115.104.126:443
190.24.45.24:995
24.9.220.167:443
68.62.199.70:443
43.241.159.238:443
113.162.196.232:443
156.217.60.239:995
197.204.70.167:443
197.202.196.43:443
24.130.228.100:443
41.109.228.108:995
64.123.103.123:443
190.193.180.228:443
24.177.111.153:443
60.54.65.27:443
189.129.38.158:2222
206.1.164.250:443
190.36.189.34:993
173.49.74.62:443
41.99.110.44:443
190.203.51.133:2222
174.29.45.113:443
222.117.141.133:443
190.207.137.189:2222
208.78.220.120:443
105.111.81.57:443
105.158.78.171:443
24.207.97.117:443
88.240.75.201:443
105.154.214.130:995
41.104.155.245:443
41.98.242.254:443
196.70.146.120:443
90.165.109.4:2222
75.84.234.68:443
65.140.11.170:443
186.154.189.162:995
191.96.67.93:995
151.213.183.141:995
184.159.76.47:443
105.98.223.169:443
190.201.145.155:443
197.0.225.39:443
78.179.135.247:443
197.2.193.4:995
152.170.17.136:443
191.33.187.192:2222
41.101.193.38:443
105.156.0.235:995
98.207.190.55:443
41.47.249.185:443
186.18.210.16:443
196.207.146.151:443
118.174.207.134:995
47.14.229.4:443
41.234.116.241:993
190.37.112.223:2222
14.54.83.15:443
93.156.96.171:443
58.186.75.42:443
189.110.3.60:2222
167.58.254.85:443
186.18.77.99:443
41.107.78.169:443
102.159.194.141:443
149.126.159.224:443
201.208.58.92:2222
156.196.169.222:443
190.100.149.122:995
1.0.215.176:443
202.5.53.143:443
206.1.222.56:2087
102.156.162.83:443
220.134.54.185:2222
190.37.174.11:2222
176.241.48.177:443
190.29.228.61:443
41.101.183.90:443
94.36.5.31:443
102.184.30.42:443
102.187.63.127:995
190.33.87.140:443
187.198.16.39:443
62.46.231.64:443
42.116.54.220:443
197.244.204.128:443
190.203.106.109:2222
200.155.61.245:995
200.155.61.245:443
105.105.46.239:443
41.143.109.111:61202
91.171.72.214:32100
136.232.184.134:995
186.52.96.202:995
163.182.177.80:443
167.56.53.143:995
181.141.3.126:443
Unpacked files
SH256 hash:
5acf78b23c92c9cb65edd1245d19c81a1c600fba2a0f35bb4d0c279117de0889
MD5 hash:
8e5285fd750919d804823f03dff49b01
SHA1 hash:
1feaeb453f536fdf383a655d748dd14af422469d
Link:
https://www.unpac.me/results/4632363d-0fcc-481d-a216-6348a2a636ef/
SH256 hash:
0430c03f2dd8132862a5c4303c56eebdce61f9087c179ba0ae94e10ef4599fc7
MD5 hash:
0971b8e78fcc6f9158e279376116c8c4
SHA1 hash:
ef69b3491f348272d58247a3832cfae762008d76
Detections:
Qakbot
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/4632363d-0fcc-481d-a216-6348a2a636ef/
SH256 hash:
6e7c6b22cb9ae14cb1df2f30bd6984dd7d7c042316540aa86a86f0cb2adfdc46
MD5 hash:
24099dc2503020948f9c74184d0c1c41
SHA1 hash:
54c0c105f79c5c265ed150e7bf74e807e8ef2807
Link:
https://www.unpac.me/results/4632363d-0fcc-481d-a216-6348a2a636ef/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e7c6b22cb9ae14cb1df2f30bd6984dd7d7c042316540aa86a86f0cb2adfdc46

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/324053/

Comments