MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b08c031d365a0b4d032c6e51bf773655e15795fe3eabcd3fa6487ffe9f3d6b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b08c031d365a0b4d032c6e51bf773655e15795fe3eabcd3fa6487ffe9f3d6b3
SHA3-384 hash: c486e59de573bbe9ff38b4f9242d8695d12f9b822845d872c524365b4f90640e56dcced0363245378acf6e3c85ecbe5c
SHA1 hash: cd0528db38e743c619341d3a542748be86d9ba72
MD5 hash: b8fb226a54197955a05705be00ff2d07
humanhash: spaghetti-eight-asparagus-network
File name:odbsikcgtqnaq.dll
Download: download sample
Signature Quakbot
Create hunting rule
File size:139'264 bytes
First seen:2022-10-09 12:57:02 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 0ca0c58d9f3aa629bfca28a0bff008e3 (3 x Quakbot)
ssdeep 3072:WDiXrECKvacoiFrT8kA7JUC7+QTBfBiya:m2YtvNbFEx7Jp7+QTBZiya
Threatray 1'505 similar samples on MalwareBazaar
TLSH T122D39E42E46280B7DA72403495CAEF2A4ABD751217A3ACC7B3886A914D905C5F73F3CF
TrID 38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.0% (.EXE) Win64 Executable (generic) (10523/12/4)
8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter syrion89
Tags:dll Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
408
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318035/
Detection(s):
Win.Trojan.Qbot-9952072-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Modifying an executable file
Creating a window
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
qakbot qbot shell32.dll windows zusy
Link:
https://www.filescan.io/uploads/6342c5234797b4990ea645eb/reports/1fcf6227-f358-44b2-aedc-bd83fb70391d/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/95cb8470-2f02-48a7-8d15-d17563bae066
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b08c031d365a0b4d032c6e51bf773655e15795fe3eabcd3fa6487ffe9f3d6b3/
Threat name:
Win32.Infostealer.QBot
Create hunting rule
Status:
Malicious
First seen:
2022-10-09 12:58:07 UTC
File Type:
PE (Dll)
AV detection:
22 of 26 (84.62%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rmemamotmwqljubsy3srx53tmvpbk6k74pvlzu72msd772pt22zq._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
1965dc57456d4fc01b6ce0f242d80776fe08a16354e6177255cba618348355ac
Quakbot
1abc2fb23f55378947bf528996b50ffed195a059d5f7b537271792704eb5cd4c
Quakbot
27fbfb86936343fc18bb61811401c96c052ecdff080da3bdb403545d55cf2b2a
Quakbot
5b54f57dbaa74fa589afb2d26d6c6b39e0c2930bd88fea3172556ce96b3eb959
Quakbot
e3a2c056c730666fedabfed5e3cc2dee12d9c3ca36ac2d7c5289cfe29c125050
Quakbot
+ 1'495 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/221009-p6yp3shaa4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
75.116.87.44:14933
64.55.103.194:9151
80.214.68.88:40730
97.184.129.40:2118
216.44.143.70:26851
239.39.127.10:38876
57.33.10.57:17737
201.128.252.151:58865
211.76.239.250:34506
124.58.65.86:13247
41.8.154.58:7614
6.55.240.195:27003
139.242.121.12:23370
8.81.30.103:64297
168.13.24.67:37382
17.219.125.20:59669
136.66.66.194:40287
63.172.177.141:57252
195.44.25.26:29277
67.212.106.154:59890
149.254.111.67:39052
184.74.22.12:50436
166.33.149.229:19515
172.102.164.60:43562
155.28.49.2:51545
7.122.114.191:33775
220.68.130.196:7948
121.236.113.177:14197
47.2.191.47:32393
49.93.218.109:41033
174.124.34.188:14831
178.143.168.245:48707
159.196.166.193:58136
1.104.105.37:49572
225.108.223.250:46683
105.208.24.120:59473
180.179.25.125:42514
236.83.216.21:0
90.29.227.242:1085
212.204.93.86:48405
115.34.223.65:24926
250.151.244.173:3488
16.95.145.59:42025
50.6.212.181:17804
23.86.160.130:53103
212.133.85.240:62503
122.125.236.31:0
Unpacked files
SH256 hash:
8b08c031d365a0b4d032c6e51bf773655e15795fe3eabcd3fa6487ffe9f3d6b3
MD5 hash:
b8fb226a54197955a05705be00ff2d07
SHA1 hash:
cd0528db38e743c619341d3a542748be86d9ba72
Detections:
Qakbot
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/0f32d4c3-6c4f-48fc-a42e-054ffd03a30d/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8b08c031d365/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/8b08c031d365a0b4d032c6e51bf773655e15795fe3eabcd3fa6487ffe9f3d6b3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:unpacked_qbot
Create hunting rule
Description:Detects unpacked or memory-dumped QBot samples
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.
Rule name:win_qakbot_malped
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropping
qakbot
  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/318035/

Comments