MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 856696fbf99ab79aebaf2c7247e56443393c2e6e464c58372aecd0101095be0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	856696fbf99ab79aebaf2c7247e56443393c2e6e464c58372aecd0101095be0c
SHA3-384 hash:	f885ea6fc011d5b652282d951b3c92ffd8eb4236ae6fb94a87e7a3ace968e3c2eab4c2a7568635d18e48780945f3b69b
SHA1 hash:	f2f9c57d9d20b2d1edb53ce6aabdedeb8528ee6a
MD5 hash:	d14884b7e7498baa75ca6614247b43f7
humanhash:	saturn-november-cardinal-delaware
File name:	856696fbf99ab79aebaf2c7247e56443393c2e6e464c58372aecd0101095be0c
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	864'155 bytes
First seen:	2022-04-14 12:18:04 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	a8e1fac8e86bd2f55e226e173348d421 (13 x Quakbot)
ssdeep	12288:QT7VyvDn5CX/JYLL+wLg+aCsnnzxS/WZ6xyK4zxfDoN+wLvp96GvZvc/ZscK6Frs:QPMb8vO3xsNxFm4zxILRtxvc/ZdK6FI
Threatray	464 similar samples on MalwareBazaar
TLSH	T1AD059FB8794818F4D7DBD63649ADB8B913B332635AC75C89015DB3C20A7F362AFC1A05
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	JAMESWT_WT
Tags:	dll Quakbot VALENTE SP Z O O

Intelligence

File Origin

# of uploads :

# of downloads :

224

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/263728/

Detection(s):

Win.Keylogger.Qbot-9942604-0

Win.Packed.Qbot-9943968-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Launching a process

Searching for synchronization primitives

Creating a window

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

conti greyware kbot overlay qakbot qbot

Link:

https://www.filescan.io/uploads/6258114f482f2f41caadecb2/reports/f3391293-994a-40e4-b2f9-47f135a309db/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/7d304b5b-50e4-4e4a-8c82-704a7cff96a5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/856696fbf99ab79aebaf2c7247e56443393c2e6e464c58372aecd0101095be0c/

Threat name:

Win32.Backdoor.Quakbot

Status:

Malicious

First seen:

2022-04-11 09:48:12 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

23 of 26 (88.46%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=qvtjn67ztk3zv25pfrzepzleim4tyltoizgfqnzk5tibaeevxyga._file

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:aa campaign:1648110482 banker stealer trojan

Link:

https://tria.ge/reports/220414-pg6dmagbbr/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Qakbot/Qbot

Malware Config

C2 Extraction:

90.120.65.153:2078
179.100.109.11:32101
24.43.99.75:443
37.186.54.166:995
47.23.89.62:993
72.76.94.99:443
117.248.109.38:21
75.99.168.194:61201
31.215.69.127:443
45.9.20.200:443
203.122.46.130:443
173.174.216.62:443
144.202.2.175:995
149.28.238.199:443
140.82.63.183:443
45.63.1.12:443
140.82.63.183:995
144.202.3.39:995
45.63.1.12:995
45.76.167.26:995
45.76.167.26:443
149.28.238.199:995
144.202.3.39:443
144.202.2.175:443
190.206.211.182:443
86.195.158.178:2222
47.23.89.62:995
70.57.207.83:443
207.170.238.231:443
217.165.85.224:993
1.161.80.99:443
39.44.127.250:995
32.221.225.247:995
5.95.58.211:2087
180.233.150.134:995
45.241.207.212:995
188.55.248.211:995
71.13.93.154:2222
39.33.182.192:995
197.2.149.15:443
121.74.182.236:995
91.177.173.10:995
83.110.85.209:995
41.230.62.211:993
70.46.220.114:443
81.60.216.223:995
172.115.177.204:2222
103.88.226.82:443
80.11.74.81:2222
114.79.148.170:443
89.101.97.139:443
172.114.160.81:995
67.209.195.198:443
75.159.9.236:443
201.172.31.135:2222
24.178.196.158:2222
41.228.22.180:443
182.191.92.203:995
37.152.80.105:443
93.48.80.198:995
92.96.183.242:2222
24.152.219.253:995
113.11.89.170:995
195.32.57.18:80
197.161.137.196:993
39.57.112.37:995
105.186.127.127:995
78.87.196.125:995
217.128.122.65:2222
120.150.218.241:995
79.52.204.9:50001
41.215.152.154:995
2.42.176.91:443
86.98.208.214:2222
190.73.3.148:2222
76.70.9.169:2222
119.158.97.217:995
74.15.2.252:2222
209.180.70.25:443
75.99.168.194:443
118.174.95.247:443
76.69.155.202:2222
78.188.76.167:443
189.146.51.56:443
108.60.213.141:443
177.97.48.132:443
176.67.56.94:443
208.107.221.224:443
148.64.96.100:443
47.180.172.159:443
140.82.49.12:443
92.96.183.242:1194
92.177.45.46:2078
96.21.251.127:2222
161.142.56.8:443
39.49.35.170:995
1.161.80.99:995
175.145.235.37:443
83.110.85.209:443
31.35.28.29:443
202.134.152.2:2222
86.98.27.253:443
5.32.41.45:443
75.188.35.168:443
103.230.180.98:443
76.25.142.196:443
173.21.10.71:2222
189.237.6.251:443
76.169.147.192:32103
71.74.12.34:443
67.165.206.193:993
47.158.25.67:443
73.151.236.31:443
174.69.215.101:443
82.41.63.217:443
45.46.53.140:2222
201.145.226.223:443
201.170.181.247:443
191.99.191.28:443
47.180.172.159:50010
69.159.200.138:2222
201.103.6.221:443
47.156.191.217:443
72.252.201.34:990
63.143.92.99:995
72.12.115.90:22
108.4.67.252:443
189.248.86.71:443
40.134.246.185:995
70.51.135.39:2222
100.1.108.246:443
24.229.150.54:995
24.55.67.176:443
72.252.201.34:995
105.225.175.168:995
179.158.105.44:443
179.178.78.112:443
200.100.246.85:32101
109.12.111.14:443
2.34.12.8:443
143.0.34.185:443
81.132.186.248:2078
82.152.39.39:443
201.172.231.204:443
186.106.197.52:443
187.211.77.68:443
196.203.37.215:80
111.125.245.118:995
176.88.238.122:995
120.61.1.91:443

Unpacked files

SH256 hash:

856696fbf99ab79aebaf2c7247e56443393c2e6e464c58372aecd0101095be0c

MD5 hash:

d14884b7e7498baa75ca6614247b43f7

SHA1 hash:

f2f9c57d9d20b2d1edb53ce6aabdedeb8528ee6a

Link:

https://www.unpac.me/results/ba0d89c4-bd66-4011-bf1f-4120ea688bfd/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.88

Link:

https://yomi.yoroi.company/submissions/856696fbf99ab79aebaf2c7247e56443393c2e6e464c58372aecd0101095be0c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.