MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 82f3ca41a9732e3917fbd6f2be17d58b5bbf0da2fb825a018a9ef2a225f39a13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	82f3ca41a9732e3917fbd6f2be17d58b5bbf0da2fb825a018a9ef2a225f39a13
SHA3-384 hash:	364455e6d3b72374e033aa48aaad71e26d95dab34ece33df0c20b5be10b4c967289e011e9a16d3ee3dd2c3161ba9e64c
SHA1 hash:	6d991651f6b8886601f9f64a2623b0ba2f628a47
MD5 hash:	906a968c833fdd1d76968d868e4b1c03
humanhash:	earth-enemy-jersey-bulldog
File name:	595265.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	349'664 bytes
First seen:	2021-01-28 16:05:48 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	036a810979f7280ed94331a2216fcf75 (2 x Quakbot)
ssdeep	6144:mpFOBdZyDntvhhOU35RJEesN83wU7HuAmHKmlEwrPmRPWEpWFn2E6sS:0FOBuvhhOKJETGByqTwr03pdfR
Threatray	62 similar samples on MalwareBazaar
TLSH	DF748D396A2AD063D27C27B183C3EB581E67D9D57234441722B3EE183EB2295BE35F14
Reporter	JAMESWT_WT
Tags:	Kayak Republic af 2015 APS Qakbot qbot Quakbot signed

Code Signing Certificate

Organisation:	Kayak Republic af 2015 APS
Issuer:	Sectigo RSA Code Signing CA
Algorithm:	sha256WithRSAEncryption
Valid from:	Jan 26 00:00:00 2021 GMT
Valid to:	Jan 26 23:59:59 2022 GMT
Serial number:	08622B9DD9D78E67678ECC21E026522E
Intelligence:	2 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:	This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:	SHA256
Thumbprint:	BC08B2BD8209891CB11ADC69616EFDBF3E6AFFF656732741960319B169359D28
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

205

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/114258/

Detection(s):

SecuriteInfo.com.Mal.EncPk-APW.1099.5802.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the Windows subdirectories

Launching a process

Modifying an executable file

Creating a process with a hidden window

Creating a window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/82f3ca41a9732e3917fbd6f2be17d58b5bbf0da2fb825a018a9ef2a225f39a13/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-01-28 16:06:06 UTC

File Type:

PE (Dll)

AV detection:

14 of 29 (48.28%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qlz4uqnjomxdsf7323zl4f6vrnn36dnc7obfuamkt3zkejpttijq._file

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:abc122 campaign:1611839863 banker stealer trojan

Link:

https://tria.ge/reports/210128-g56qmmlyke/

Behaviour

Checks SCSI registry key(s)

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Loads dropped DLL

Qakbot/Qbot

Malware Config

C2 Extraction:

71.182.142.63:443
172.78.30.215:443
217.133.54.140:32100
193.248.221.184:2222
80.227.5.70:443
50.29.166.232:995
81.97.154.100:443
80.11.5.65:2222
190.85.91.154:443
176.181.247.197:443
95.77.223.148:443
85.132.36.111:2222
85.52.72.32:2222
83.110.108.181:2222
77.211.30.202:995
172.115.177.204:2222
84.72.35.226:443
149.28.98.196:2222
45.32.211.207:2222
77.27.174.49:995
149.28.101.90:2222
149.28.99.97:2222
45.32.211.207:443
207.246.77.75:995
207.246.77.75:2222
207.246.77.75:8443
144.202.38.185:995
207.246.116.237:443
207.246.116.237:8443
207.246.116.237:2222
149.28.99.97:443
149.28.99.97:995
149.28.101.90:443
149.28.101.90:995
149.28.98.196:995
45.77.115.208:443
45.63.107.192:443
149.28.98.196:443
144.202.38.185:443
45.63.107.192:2222
207.246.77.75:443
45.63.107.192:995
45.32.211.207:995
45.32.211.207:8443
207.246.116.237:995
45.77.115.208:2222
144.202.38.185:2222
149.28.101.90:8443
92.59.35.196:2222
2.50.2.216:443
202.186.176.15:443
184.189.122.72:443
82.76.47.211:443
71.74.12.34:443
24.139.72.117:443
106.51.52.111:443
45.77.115.208:8443
45.77.115.208:995
83.110.12.140:2222
172.87.157.235:3389
81.88.254.62:443
197.161.154.132:443
47.22.148.6:443
175.141.219.71:443
86.236.77.68:2222
50.240.77.238:22
24.50.118.93:443
85.58.200.50:2222
78.182.229.147:443
125.63.101.62:443
86.98.93.124:2078
70.126.76.75:443
64.121.114.87:443
67.6.91.75:443
196.151.252.84:443
50.244.112.106:443
140.82.49.12:443
2.7.69.217:2222
89.3.198.238:443
2.232.253.79:995
47.196.192.184:443
213.60.147.140:443
105.186.102.16:443
96.37.113.36:993
188.25.63.105:443
41.205.16.28:443
216.201.162.158:443
71.187.170.235:443
68.186.192.69:443
108.46.145.30:443
105.198.236.101:443
68.225.60.77:995
78.63.226.32:443
75.136.40.155:443
79.129.121.81:995
197.45.110.165:995
2.50.153.20:2222
160.3.187.114:443
105.198.236.99:443
75.67.192.125:443
81.150.181.168:2222
81.214.126.173:2222
98.121.187.78:443
37.211.83.41:443
67.8.103.21:443
188.24.128.253:443
69.58.147.82:2078
75.136.26.147:443
202.79.19.221:443
76.25.142.196:443
115.133.243.6:443
202.188.138.162:443
27.223.92.142:995
144.139.47.206:443
173.21.10.71:2222
31.5.21.66:995
203.198.96.37:443
84.232.252.202:2222
106.250.150.98:443
94.53.92.42:443
75.118.1.141:443
125.239.152.76:995
161.199.180.159:443
122.148.156.131:995
144.139.166.18:443
47.156.65.184:443
100.2.123.122:443
45.46.53.140:2222
151.60.15.183:443
76.111.128.194:443
172.5.239.229:443
209.210.187.52:995
71.14.110.199:443
199.19.117.131:443
189.131.227.128:443
74.68.144.202:443
189.222.111.204:443
186.155.151.167:443
189.211.177.183:995
189.210.115.207:443
69.123.179.70:443
187.250.45.81:995
100.36.107.157:443
189.237.26.15:443
71.197.126.250:443
151.205.102.42:443
98.240.24.57:443
172.87.134.226:995
68.129.194.130:443
72.240.200.181:2222

Unpacked files

SH256 hash:

62c2e9c0996a364fba8a94a236025de07350f389eab262078b0e137e6b44fd34

MD5 hash:

dbcaa0b81177d019ebf1c2e25f30ab13

SHA1 hash:

90cec7ad97272591ef8ca6ca21aec0f4d3d22ad6

Link:

https://www.unpac.me/results/8e67eeb6-71a2-4b50-a96d-da9488008eff/

SH256 hash:

82f3ca41a9732e3917fbd6f2be17d58b5bbf0da2fb825a018a9ef2a225f39a13

MD5 hash:

906a968c833fdd1d76968d868e4b1c03

SHA1 hash:

6d991651f6b8886601f9f64a2623b0ba2f628a47

Link:

https://www.unpac.me/results/8e67eeb6-71a2-4b50-a96d-da9488008eff/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/82f3ca41a9732e3917fbd6f2be17d58b5bbf0da2fb825a018a9ef2a225f39a13

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QakBot Create hunting rule
Author:	kevoreilly
Description:	QakBot Payload

Rule name:	qbot_bin Create hunting rule
Author:	James_inthe_box
Description:	Qbot Qakbot
Reference:	https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02