MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 78b55c9b294bdbc2642cd2d9377ab54ac80596fc680e35111d9496409e88080a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 78b55c9b294bdbc2642cd2d9377ab54ac80596fc680e35111d9496409e88080a
SHA3-384 hash: 62c9f6effb2582509454406f759857ab994b6f580702e5c10f367475806c681c2427b0b041fbcb8bfa4e7365147bc781
SHA1 hash: ab9bae1edb6c2a4946d98403ca6e565328a172bb
MD5 hash: d3fccce7637c4f09159d811e0c3b211d
humanhash: kilo-washington-uncle-football
File name:n2
Download: download sample
Signature Quakbot
Create hunting rule
File size:266'721 bytes
First seen:2021-11-29 13:43:57 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 3bc41ab907dcf32970630360a7a2019f (12 x Heodo, 1 x Quakbot, 1 x Gozi)
ssdeep 6144:ISpoLKyAyxcDgEzQbgO8+CNjApPjrH1SrrE9pQQ:I0DyxcDebBwNoH1cA9pB
Threatray 389 similar samples on MalwareBazaar
TLSH T17344F10037D2D876D17D18341579C6A25AAEFA61CFD49CDF1FD2073A0E702E0A93AD66
Reporter Anonymous
Tags:dll Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Searching for synchronization primitives
Launching the default Windows debugger (dwwin.exe)
DNS request
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
greyware monero overlay
Link:
https://www.filescan.io/uploads/61a4d924effcae2254f48080/reports/caace5e6-8346-4c6d-aec7-57fb97377ad2/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2a3c6e80-7536-46c2-89ca-90525dbbdaba
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/897890
Signature
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 530368 Sample: n2 Startdate: 29/11/2021 Architecture: WINDOWS Score: 52 35 Multi AV Scanner detection for submitted file 2->35 37 Machine Learning detection for sample 2->37 8 loaddll32.exe 1 2->8         started        process3 process4 10 iexplore.exe 1 73 8->10         started        12 cmd.exe 1 8->12         started        14 regsvr32.exe 8->14         started        16 3 other processes 8->16 process5 18 iexplore.exe 131 10->18         started        21 rundll32.exe 12->21         started        23 WerFault.exe 14->23         started        25 WerFault.exe 16->25         started        dnsIp6 29 btloader.com 104.26.6.139, 443, 49826, 49827 CLOUDFLARENETUS United States 18->29 31 lg3.media.net 2.18.160.23, 443, 49796, 49797 AKAMAI-ASUS European Union 18->31 33 4 other IPs or domains 18->33 27 WerFault.exe 21->27         started        process7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/78b55c9b294bdbc2642cd2d9377ab54ac80596fc680e35111d9496409e88080a/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2021-11-29 13:44:08 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
23 of 27 (85.19%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
283318a272b4164ad445104b29583a873b16e9d5f8c5976e994f513cd3390fd3
Quakbot
2b06b75f6b51eb26fccc795e4a8f7923119ddf60d4a6f3170c1867cf8dc62fb0
Quakbot
3cde8a896848e9c28ccfcc2db7812602143de7be90aa44fcfe83c85ac7e53f9b
Quakbot
3f7fa2310698749705e4b22ef4e17fcc1e2490b63e803bc9f25d47e0c932e4d0
Quakbot
74ddf08baf8103c7c9101cb2a837c359e01b8c71b9afa92b26dd09851c4a358e
Quakbot
c280803318fcc959993a058b17616e02a2101b910287033a8f26559c94277f69
Quakbot
+ 379 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:tr campaign:1638169086 banker stealer trojan
Link:
https://tria.ge/reports/211129-q1tdvacbdr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Qakbot/Qbot
Malware Config
C2 Extraction:
136.232.34.70:443
117.248.109.38:21
218.101.110.3:995
140.82.49.12:443
102.65.38.57:443
136.143.11.232:443
39.33.188.131:995
76.25.142.196:443
120.150.218.241:995
189.252.156.7:32101
185.53.147.51:443
103.142.10.177:443
117.198.159.148:443
217.165.237.42:443
216.238.71.31:443
207.246.112.221:995
207.246.112.221:443
45.46.53.140:2222
173.21.10.71:2222
67.165.206.193:993
189.135.21.162:443
71.74.12.34:443
86.8.177.143:443
174.20.72.123:443
73.151.236.31:443
94.60.254.81:443
89.137.52.44:443
89.101.97.139:443
109.12.111.14:443
68.204.7.158:443
27.5.4.111:2222
129.208.177.244:995
105.198.236.99:995
65.100.174.110:8443
94.200.181.154:443
65.100.174.110:995
63.143.92.99:995
201.172.31.95:80
75.188.35.168:995
186.64.67.16:443
39.49.33.135:995
182.176.180.73:443
194.36.28.26:443
103.116.178.85:993
75.66.88.33:443
187.156.138.52:443
200.114.247.160:465
189.147.174.121:443
24.139.72.117:443
75.169.58.229:32100
5.31.189.54:995
86.120.85.147:443
93.48.80.198:995
2.222.167.138:443
197.89.6.112:443
27.57.252.156:443
103.150.40.76:995
41.228.22.180:443
81.250.153.227:2222
88.244.161.183:995
111.250.48.162:443
50.194.160.233:32100
50.194.160.233:443
24.55.112.61:443
73.140.38.124:443
108.4.67.252:443
176.63.117.1:22
100.1.119.41:443
24.229.150.54:995
111.91.87.187:443
86.97.10.14:443
220.255.25.187:2222
92.59.35.196:2222
72.252.201.34:465
209.210.95.228:443
68.186.192.69:443
187.121.105.111:995
103.168.241.157:995
103.168.241.157:465
86.190.203.103:443
93.147.212.206:443
5.238.149.217:61202
72.252.201.34:995
24.152.219.253:995
96.37.113.36:993
45.9.20.200:2211
190.73.3.148:2222
80.6.192.58:443
103.116.178.85:61200
93.48.58.123:2222
27.223.92.142:995
91.178.126.51:995
41.235.5.174:443
96.246.158.154:995
50.194.160.233:465
96.21.251.127:2222
216.238.71.31:995
216.238.72.121:995
216.238.72.121:443
Unpacked files
SH256 hash:
8424755c283c41cae0f8b993e9596fc92a85159ce6ee3e89a45145e67fcc682c
MD5 hash:
db308557f30eb729b74177b092665e38
SHA1 hash:
de4c824ae971ba2026343c8b40f089dfe029c46b
Link:
https://www.unpac.me/results/196ed2da-4051-41a4-ad45-1a976b72ac7f/
SH256 hash:
78b55c9b294bdbc2642cd2d9377ab54ac80596fc680e35111d9496409e88080a
MD5 hash:
d3fccce7637c4f09159d811e0c3b211d
SHA1 hash:
ab9bae1edb6c2a4946d98403ca6e565328a172bb
Link:
https://www.unpac.me/results/196ed2da-4051-41a4-ad45-1a976b72ac7f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/78b55c9b294bdbc2642cd2d9377ab54ac80596fc680e35111d9496409e88080a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

DLL dll 78b55c9b294bdbc2642cd2d9377ab54ac80596fc680e35111d9496409e88080a

(this sample)

  
Delivery method
Distributed via web download

Comments