MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a
SHA3-384 hash: 94d50941262f000f95ab325ce290efa93bf226e7da3472ecd3bb8827a515af3518fb1294cd97fbb789ccfc0552d6487a
SHA1 hash: 7198cb968a60f7e6f80492e43c146865812388a2
MD5 hash: 92888979e33ce98460220aca2ca69582
humanhash: football-uranus-double-neptune
File name:92888979e33ce98460220aca2ca69582.dll
Download: download sample
Signature Quakbot
Create hunting rule
File size:1'493'216 bytes
First seen:2021-05-04 15:56:59 UTC
Last seen:2021-05-04 17:03:07 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 413398ffac649594b2b53c025e6614ac (8 x Quakbot)
ssdeep 24576:LAboz/I6budWhdq9EROsB3OPh1tWVJFgQbpXLGmw5:sbeeGRuPPu7U
Threatray 1'366 similar samples on MalwareBazaar
TLSH CC657C31B1D2C437D473267C9D7AA29D982A7D111E28985B7AE40F4CDF3A6803E2D2D7
Reporter abuse_ch
Tags:dll Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.10522.32554.14071.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a UDP request
Launching a process
Modifying an executable file
Creating a process with a hidden window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/710367
Signature
Allocates memory in foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 404104 Sample: NtT6ycEFV9.dll Startdate: 04/05/2021 Architecture: WINDOWS Score: 84 42 Malicious sample detected (through community Yara rule) 2->42 44 Multi AV Scanner detection for submitted file 2->44 46 Machine Learning detection for sample 2->46 8 loaddll32.exe 1 2->8         started        11 regsvr32.exe 2->11         started        13 regsvr32.exe 2->13         started        process3 signatures4 48 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->48 50 Injects code into the Windows Explorer (explorer.exe) 8->50 52 Writes to foreign memory regions 8->52 54 2 other signatures 8->54 15 explorer.exe 8 1 8->15         started        19 cmd.exe 1 8->19         started        21 regsvr32.exe 11->21         started        23 regsvr32.exe 13->23         started        process5 file6 36 C:\Users\user\Desktop36tT6ycEFV9.dll, PE32 15->36 dropped 40 Uses schtasks.exe or at.exe to add and modify task schedules 15->40 25 schtasks.exe 1 15->25         started        27 rundll32.exe 19->27         started        29 WerFault.exe 17 9 21->29         started        signatures7 process8 process9 31 conhost.exe 25->31         started        33 WerFault.exe 23 9 27->33         started        dnsIp10 38 192.168.2.1 unknown unknown 33->38
Detection:
qbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a/
Threat name:
Win32.Infostealer.QBot
Create hunting rule
Status:
Malicious
First seen:
2021-05-04 15:57:10 UTC
AV detection:
36 of 47 (76.60%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
59d168db7a2c5ecc89e81462b9f3bcff49d6296e186a0508be254bab06723c5c
Quakbot
5cf03d4c4ed5a25dc90ecc5b2b4624c808b901a308e1eac4881e87460eff05ab
Quakbot
6a1ff8895e465dcb6f9f6f8cbc1e553244348114b4d90d860e6a329c2435f26c
Quakbot
74f0785920d9fa06c19c0632f6d5253a0b6488a3b164e1cbd383f29fbbf10056
Quakbot
80cfabe6a394c7737a22d5ea72c604fb65fb6b66e979e848d07507343fbdb705
Quakbot
8f05dd46b35aa52cca1e09ce7ab7768faad1d4ad9c8b1374625890616281a800
Quakbot
b12073d6fb10eaa5c2d201c069693f72a45f53df4239ef34d5e4608a084603a4
Quakbot
b93a9e972d297bb2a0ae163d5c9a087bf29dc5db48eaab8d9e0e5560f48065c0
Quakbot
c308fad8b51897092093524fc7260d49e5ebc9ae176a3f8d1e8ce4814b5ea9d3
Quakbot
c5db8f1fd3c0c9e620a614cca194af7f1c1066c30e1cd79a948e039b644db0f6
Quakbot
+ 1'356 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:tr campaign:1618225074 banker stealer trojan
Link:
https://tria.ge/reports/210504-1w1q9nm99n/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Malware Config
C2 Extraction:
197.45.110.165:995
216.201.162.158:443
71.74.12.34:443
45.63.107.192:2222
149.28.101.90:2222
45.32.211.207:443
45.32.211.207:995
45.32.211.207:8443
45.32.211.207:2222
149.28.99.97:995
149.28.98.196:443
149.28.101.90:443
149.28.101.90:8443
207.246.77.75:2222
207.246.116.237:443
207.246.116.237:995
207.246.116.237:2222
45.77.117.108:995
149.28.99.97:443
45.63.107.192:443
149.28.98.196:2222
149.28.98.196:995
144.202.38.185:2222
144.202.38.185:443
149.28.101.90:995
45.77.115.208:443
45.77.115.208:995
45.77.115.208:2222
45.77.115.208:8443
207.246.77.75:443
207.246.77.75:995
207.246.77.75:8443
207.246.116.237:8443
45.77.117.108:443
45.77.117.108:2222
45.77.117.108:8443
45.63.107.192:995
144.202.38.185:995
90.65.236.181:2222
97.69.160.4:2222
47.22.148.6:443
71.41.184.10:3389
73.25.124.140:2222
24.152.219.253:995
47.196.192.184:443
86.190.41.156:443
105.198.236.99:443
24.117.107.120:443
188.26.91.212:443
81.97.154.100:443
71.187.170.235:443
193.248.221.184:2222
75.67.192.125:443
96.61.23.88:995
78.63.226.32:443
27.223.92.142:995
140.82.49.12:443
190.85.91.154:443
105.198.236.101:443
136.232.34.70:443
115.133.243.6:443
149.28.99.97:2222
173.21.10.71:2222
50.29.166.232:995
75.118.1.141:443
45.46.53.140:2222
109.12.111.14:443
76.25.142.196:443
95.77.223.148:443
71.197.126.250:443
67.165.206.193:993
94.59.106.186:2078
83.110.109.164:2222
108.14.4.202:443
98.252.118.134:443
24.43.22.221:993
71.163.222.243:443
189.210.115.207:443
64.121.114.87:443
151.205.102.42:443
24.229.150.54:995
24.139.72.117:443
72.252.201.69:443
98.192.185.86:443
75.137.47.174:443
186.28.181.226:443
72.240.200.181:2222
86.220.62.251:2222
144.139.47.206:443
96.37.113.36:993
24.55.112.61:443
222.153.174.162:995
24.226.156.153:443
172.78.56.208:443
67.8.103.21:443
77.27.207.217:995
24.95.61.62:443
77.211.30.202:995
92.59.35.196:2222
106.51.52.111:995
50.244.112.106:443
184.189.122.72:443
195.12.154.8:443
68.186.192.69:443
75.136.40.155:443
71.117.132.169:443
96.21.251.127:2222
71.199.192.62:443
70.168.130.172:995
83.196.56.65:2222
81.214.126.173:2222
82.12.157.95:995
209.210.187.52:995
209.210.187.52:443
67.6.12.4:443
189.222.59.177:443
174.104.22.30:443
142.117.191.18:2222
189.146.183.105:443
213.60.147.140:443
196.221.207.137:995
108.46.145.30:443
187.250.238.164:995
2.7.116.188:2222
195.43.173.70:443
106.250.150.98:443
45.67.231.247:443
83.110.103.152:443
83.110.9.71:2222
78.97.207.104:443
59.90.246.200:443
80.227.5.69:443
125.63.101.62:443
86.236.77.68:2222
109.106.69.138:2222
84.72.35.226:443
217.133.54.140:32100
197.161.154.132:443
89.137.211.239:995
74.222.204.82:995
122.148.156.131:995
156.223.110.23:443
144.139.166.18:443
202.185.166.181:443
76.94.200.148:995
71.63.120.101:443
196.151.252.84:443
202.188.138.162:443
74.68.144.202:443
69.58.147.82:2078
Unpacked files
SH256 hash:
f3c45fb5349fc3768ce82676a7b687cefefe91f74eb44af339409b5cdb2ef64e
MD5 hash:
dc2acf1704456880208146c91692cfc8
SHA1 hash:
a5614434268e792a80439e8517381b1a2ccd0834
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/904efba1-891e-4e02-9d33-0acacbdda735/
Parent samples :
5cf03d4c4ed5a25dc90ecc5b2b4624c808b901a308e1eac4881e87460eff05ab
71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a
cdb955547f9718c2755a828c8b3d5a4baa2e97f31ba77fadef01e78abb8f3b68
3c40784862d5a82b93baaa62432b2903048c5fcfaa9d3d31cebb96ae4980ddd4
SH256 hash:
71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a
MD5 hash:
92888979e33ce98460220aca2ca69582
SHA1 hash:
7198cb968a60f7e6f80492e43c146865812388a2
Link:
https://www.unpac.me/results/904efba1-891e-4e02-9d33-0acacbdda735/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

DLL dll 71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1107438/
  
Delivery method
Distributed via web download

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-04 16:12:29 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.025] Anti-Behavioral Analysis::Software Breakpoints
1) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
2) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
3) [F0002.002] Collection::Polling
5) [B0030.002] Command and Control::Receive Data
6) [B0030.001] Command and Control::Send Data
7) [C0002.009] Communication Micro-objective::Connect to Server::HTTP Communication
8) [C0002.012] Communication Micro-objective::Create Request::HTTP Communication
9) [C0002.017] Communication Micro-objective::Get Response::HTTP Communication
10) [C0002.005] Communication Micro-objective::Send Data::HTTP Communication
11) [C0002.003] Communication Micro-objective::Send Request::HTTP Communication
12) [C0019] Data Micro-objective::Check String
13) [C0026.001] Data Micro-objective::Base64::Encode Data
14) [C0026.002] Data Micro-objective::XOR::Encode Data
16) [C0047] File System Micro-objective::Delete File
17) [C0051] File System Micro-objective::Read File
18) [C0052] File System Micro-objective::Writes File
19) [C0007] Memory Micro-objective::Allocate Memory
20) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
21) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
22) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
23) [C0040] Process Micro-objective::Allocate Thread Local Storage
24) [C0038] Process Micro-objective::Create Thread
25) [C0041] Process Micro-objective::Set Thread Local Storage Value
26) [C0018] Process Micro-objective::Terminate Process