MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78b5037730ace782342efc777e3922272389e35fbb96af159ee0d2af73abe7ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78b5037730ace782342efc777e3922272389e35fbb96af159ee0d2af73abe7ca
SHA3-384 hash: 656ce970925a41cc6fad289947e79987ebef270f5e47e9a4b254fdbab25947a67dc58e71e1ea6e5c624a425250e20a8d
SHA1 hash: 2e03d99a7cd06f2d498f5abd199d03f1a43284d3
MD5 hash: cb260448cc4553f2ee0dcd8633e14bce
humanhash: equal-stairway-maine-winner
File name:78b5037730ace782342efc777e3922272389e35fbb96af159ee0d2af73abe7ca
Download: download sample
Signature Quakbot
Create hunting rule
File size:658'400 bytes
First seen:2021-05-18 10:50:36 UTC
Last seen:2021-05-20 10:03:50 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash cc5314d702d86254704833677f6413ce (3 x Quakbot)
ssdeep 6144:EeHkz9EeBfCFH7OE71J8JRO+njE2X2J/7vKsakTixuu8njFBmvWn3:6z9EqfCFHye1+lFGwuu8njFwvI
Threatray 1'416 similar samples on MalwareBazaar
TLSH 26E44977BBDEC512FB271FBEB1938A1404F2EC932572512E01E13A15F976AB028A5734
Reporter JAMESWT_WT
Tags:ACTIVUS LIMITED dll Qakbot qbot Quakbot signed

Code Signing Certificate

Organisation:ACTIVUS LIMITED
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2021-03-12T00:00:00Z
Valid to:2022-03-12T23:59:59Z
Serial number: 1ffc9825644caf5b1f521780c5c7f42c
Intelligence: 5 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 74de054c3276300866708085c45ebb1d2bff0c94c402f3ed0ee0f52f98d2c52b
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
128
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/158012/
Detection(s):
Win.Packed.Malcert-9801091-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Sending a UDP request
Launching a process
Modifying an executable file
Creating a process with a hidden window
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/783961
Signature
Allocates memory in foreign processes
Contain functionality to detect virtual machines
Injects code into the Windows Explorer (explorer.exe)
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 416357 Sample: RuYjNzhoBY Startdate: 18/05/2021 Architecture: WINDOWS Score: 84 69 Malicious sample detected (through community Yara rule) 2->69 71 Multi AV Scanner detection for submitted file 2->71 10 loaddll32.exe 1 2->10         started        13 regsvr32.exe 2->13         started        15 regsvr32.exe 2->15         started        process3 signatures4 73 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 10->73 75 Injects code into the Windows Explorer (explorer.exe) 10->75 77 Maps a DLL or memory area into another process 10->77 17 regsvr32.exe 10->17         started        20 cmd.exe 1 10->20         started        22 rundll32.exe 10->22         started        28 2 other processes 10->28 24 regsvr32.exe 13->24         started        26 regsvr32.exe 15->26         started        process5 file6 59 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 17->59 61 Injects code into the Windows Explorer (explorer.exe) 17->61 63 Writes to foreign memory regions 17->63 31 explorer.exe 17->31         started        34 rundll32.exe 20->34         started        65 Allocates memory in foreign processes 22->65 67 Maps a DLL or memory area into another process 22->67 36 explorer.exe 22->36         started        38 WerFault.exe 24->38         started        40 WerFault.exe 26->40         started        51 C:\Users\user\Desktop\RuYjNzhoBY.dll, PE32 28->51 dropped 42 iexplore.exe 154 28->42         started        signatures7 process8 dnsIp9 79 Contain functionality to detect virtual machines 31->79 81 Uses schtasks.exe or at.exe to add and modify task schedules 31->81 83 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 34->83 85 Injects code into the Windows Explorer (explorer.exe) 34->85 87 Writes to foreign memory regions 34->87 89 2 other signatures 34->89 45 explorer.exe 8 1 34->45         started        53 img.img-taboola.com 42->53 55 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49764, 49765 FASTLYUS United States 42->55 57 8 other IPs or domains 42->57 signatures10 process11 process12 47 schtasks.exe 45->47         started        process13 49 conhost.exe 47->49         started       
Detection:
qbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/78b5037730ace782342efc777e3922272389e35fbb96af159ee0d2af73abe7ca/
Threat name:
Win32.Trojan.Bsymem
Create hunting rule
Status:
Malicious
First seen:
2021-05-18 01:35:14 UTC
File Type:
PE (Dll)
Extracted files:
8
AV detection:
18 of 47 (38.30%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pc2qg5zqvttyenbo7r3x4ojce4ryty27xolk6fm64djk645l47fa._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
1a57dd305adb1ae4449a0baa9ee76a1b79477d7e7ad380319429f22fc9e96978
Quakbot
378a6fdf9d2629f912926cdee7dbe401675d31dda23fa6a0b5a150db80e62739
Quakbot
39b946880e4f2b9a2ba7b81a53256d0bd191650b3827525033fc07ddf159ef50
Quakbot
4b0e369110e96165597a539d484ffaf84ed54a7761fd07540dc1d6fc848639a7
Quakbot
593fe4509474a9bff2935b4ccd3ea7ebe962052f2b635a74d27936a443e4b611
Quakbot
5b26445c5b5b2f913b70508718cfd4d45ddf9c13a372cbe1beed26607d76c169
Quakbot
6a2f09ad89f9c7dc4087e09fd90a5a9acbe0aaedfb5b81b177e0933c7bae677e
Quakbot
a4da89c7bbcd7bee6d6e67772a906f43bb52f3f6e7ad5fb6c261cb2a1b36bb18
Quakbot
ae3055c19ad423ef263d41db3a3b5bfbb435dc5027acd20e9f115cd89554f5da
Quakbot
d61e90fe268528db7a0eee66f064270a519b2843a59642923b137ec2b81fe5e2
Quakbot
+ 1'406 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:clinton18 campaign:1621242367 banker stealer trojan
Link:
https://tria.ge/reports/210518-cnla795adn/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Malware Config
C2 Extraction:
71.187.170.235:443
86.248.16.253:2222
86.155.88.48:443
188.26.91.212:443
86.220.62.251:2222
75.67.192.125:443
71.163.224.97:443
81.97.154.100:443
98.192.185.86:443
105.198.236.99:443
140.82.49.12:443
68.204.7.158:443
92.96.3.180:2078
47.22.148.6:443
105.198.236.101:443
149.28.101.90:8443
207.246.116.237:443
144.202.38.185:995
207.246.77.75:2222
45.77.115.208:2222
149.28.101.90:995
45.77.115.208:8443
144.202.38.185:2222
45.77.117.108:2222
149.28.98.196:443
149.28.101.90:2222
207.246.116.237:8443
149.28.98.196:2222
207.246.77.75:995
207.246.116.237:2222
45.77.117.108:995
45.77.117.108:8443
149.28.98.196:995
45.77.115.208:443
45.77.115.208:995
45.32.211.207:8443
207.246.77.75:8443
149.28.101.90:443
45.32.211.207:995
144.202.38.185:443
207.246.77.75:443
45.32.211.207:2222
207.246.116.237:995
45.32.211.207:443
45.77.117.108:443
115.133.243.6:443
190.85.91.154:443
216.201.162.158:443
71.41.184.10:3389
97.69.160.4:2222
27.223.92.142:995
184.185.103.157:443
95.77.223.148:443
24.179.77.148:443
172.78.43.46:443
45.63.107.192:2222
45.63.107.192:443
197.45.110.165:995
24.122.166.173:443
45.63.107.192:995
149.28.99.97:2222
149.28.99.97:443
149.28.99.97:995
144.139.47.206:443
173.21.10.71:2222
222.153.124.130:995
75.118.1.141:443
73.151.236.31:443
76.25.142.196:443
96.37.113.36:993
71.74.12.34:443
109.12.111.14:443
83.110.109.252:2222
67.165.206.193:993
98.252.118.134:443
75.137.47.174:443
189.210.115.207:443
72.252.201.69:443
24.139.72.117:443
151.205.102.42:443
136.232.34.70:443
24.229.150.54:995
72.240.200.181:2222
24.55.112.61:443
47.196.213.73:443
50.29.166.232:995
45.46.53.140:2222
108.29.134.37:443
24.152.219.253:995
81.214.126.173:2222
73.25.124.140:2222
50.244.112.106:443
186.154.175.13:443
70.163.161.79:443
24.95.61.62:443
68.186.192.69:443
92.59.35.196:2222
78.63.226.32:443
83.196.56.65:2222
195.6.1.154:2222
76.168.147.166:993
96.61.23.88:995
64.121.114.87:443
77.27.207.217:995
77.211.30.202:995
125.62.192.220:443
195.12.154.8:443
71.117.132.169:443
96.21.251.127:2222
71.199.192.62:443
70.168.130.172:995
82.12.157.95:995
209.210.187.52:995
209.210.187.52:443
67.6.12.4:443
189.222.59.177:443
174.104.22.30:443
142.117.191.18:2222
189.146.183.105:443
213.60.147.140:443
196.221.207.137:995
108.46.145.30:443
187.250.238.164:995
2.7.116.188:2222
195.43.173.70:443
106.250.150.98:443
45.67.231.247:443
83.110.103.152:443
83.110.9.71:2222
78.97.207.104:443
59.90.246.200:443
80.227.5.69:443
125.63.101.62:443
86.236.77.68:2222
109.106.69.138:2222
84.72.35.226:443
217.133.54.140:32100
197.161.154.132:443
89.137.211.239:995
74.222.204.82:995
122.148.156.131:995
156.223.110.23:443
144.139.166.18:443
202.185.166.181:443
76.94.200.148:995
71.63.120.101:443
196.151.252.84:443
202.188.138.162:443
74.68.144.202:443
69.58.147.82:2078
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/158012/

Comments


Avatar
a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-18 10:59:43 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [C0026.002] Data Micro-objective::XOR::Encode Data