MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b3eb1b66e5ae2882ac4581cf3d512fe2013eefa150b897fcf73c885c83a620a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 11


Intelligence 11 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b3eb1b66e5ae2882ac4581cf3d512fe2013eefa150b897fcf73c885c83a620a
SHA3-384 hash: 9fffe33fbb544faf5866f6fc77f9f21b4af412c78a27844448e29c726be23e63801d36d39bb98fd1cef0e0924d060f2e
SHA1 hash: 89f3da9f171b32cbd1bfa7fec7ed6a93c2082206
MD5 hash: 8a9347905dc7a332b35a2e680abba535
humanhash: vermont-hydrogen-south-johnny
File name:7790983516.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:734'208 bytes
First seen:2022-04-15 16:28:54 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 1af479bde1363d7983f378908d494d95 (7 x Quakbot)
ssdeep 12288:b1WOAct8HDgwRanGvLXO/s3kJvOjRir3NtttKvMK3+9Uy4+fXwo53Z824cH:b1KO8jgwRaGvDO03ktOtixtfKvA/fwov
Threatray 478 similar samples on MalwareBazaar
TLSH T1B2F4AFB875047DD6E5AE467BDD96ACDC13B62773C9CBA5CC80647BC309A3326EE02805
TrID 38.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
26.3% (.EXE) Win32 Executable (generic) (4505/5/1)
11.8% (.EXE) OS/2 Executable (generic) (2029/13)
11.6% (.EXE) Generic Win/DOS Executable (2002/3)
11.6% (.EXE) DOS Executable Generic (2000/1)
Reporter proxylife
Tags:dll obama175 Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
296
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/264008/
Detection(s):
Win.Trojan.Qbot-9944106-0
Create hunting rule

Win.Trojan.Qbot-9944107-0
Create hunting rule

Win.Trojan.Qbot-9944109-0
Create hunting rule

Win.Packed.Lazy-9944155-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Creating a window
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
qbot
Link:
https://www.filescan.io/uploads/62599d5bffe27d5119dc5aed/reports/cf88a549-42cb-4566-8f93-8bd1084fb4dd/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/684131ad-8e73-4457-9171-f6c32c91bebe
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/977479
Signature
Allocates memory in foreign processes
Found malware configuration
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Suspicious Call by Ordinal
Writes to foreign memory regions
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 609966 Sample: 7790983516.dat Startdate: 15/04/2022 Architecture: WINDOWS Score: 88 35 Found malware configuration 2->35 37 Multi AV Scanner detection for submitted file 2->37 39 Yara detected Qbot 2->39 41 Sigma detected: Suspicious Call by Ordinal 2->41 8 loaddll32.exe 1 2->8         started        process3 signatures4 43 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->43 45 Injects code into the Windows Explorer (explorer.exe) 8->45 47 Writes to foreign memory regions 8->47 49 2 other signatures 8->49 11 regsvr32.exe 8->11         started        14 cmd.exe 1 8->14         started        16 rundll32.exe 8->16         started        18 3 other processes 8->18 process5 signatures6 51 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 11->51 53 Injects code into the Windows Explorer (explorer.exe) 11->53 55 Writes to foreign memory regions 11->55 57 2 other signatures 11->57 20 explorer.exe 8 1 11->20         started        22 rundll32.exe 14->22         started        24 WerFault.exe 9 16->24         started        27 WerFault.exe 9 18->27         started        29 WerFault.exe 23 9 18->29         started        process7 dnsIp8 31 WerFault.exe 2 9 22->31         started        33 192.168.2.1 unknown unknown 24->33 process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b3eb1b66e5ae2882ac4581cf3d512fe2013eefa150b897fcf73c885c83a620a/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-04-15 16:29:19 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rm7ldntollriqkwelaophvis7yqbh3x2cufys76popeilsb2mifa._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
3603edd9bba069c5a26d1a88fae7ba22d7cdfc876f6d7524f4807878ba888fba
Quakbot
509553272b0a639d2bcd41e5358be61f4caad435bcdac1cb02fa825034068009
Quakbot
795dfd11462e52d90eff5777f2842e503bb352441e86877e1822708631fab34c
Quakbot
df8d431b3d7193b0d0d6667b269ef1b2431086343bf86a41c3a2a2488d9f1567
Quakbot
f2f87129d1786fd86f0ec659457aae0e186c023a19f63d207c17b28dc63ae2e9
Quakbot
f696d06d6579ee33cf8be2987f292370abe1b4b64a0d88631f5860f451e87320
Quakbot
f6e7187a8e0aa202fe89008b5a5cc5e99dc5c3aaede7213283cae41dc7cb3ebc
Quakbot
fe736c1118633748586090fdf6c8df78355d622b636b32792798f2ce00f66069
Quakbot
+ 468 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama175 campaign:1649748306 banker stealer trojan
Link:
https://tria.ge/reports/220415-tzbn7ahgdk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
76.69.155.202:2222
72.66.116.235:995
103.107.113.120:443
113.11.89.165:995
208.107.221.224:443
103.88.226.30:443
75.99.168.194:443
75.113.214.234:2222
76.169.147.192:32103
190.73.3.148:2222
39.52.2.90:995
38.70.253.226:2222
5.95.58.211:2087
74.15.2.252:2222
76.70.9.169:2222
121.74.167.191:995
197.167.62.14:993
108.60.213.141:443
47.23.89.62:993
86.97.247.20:2222
47.23.89.62:995
176.67.56.94:443
86.98.33.251:443
96.37.113.36:993
148.64.96.100:443
47.180.172.159:443
140.82.49.12:443
80.11.74.81:2222
96.21.251.127:2222
177.158.7.155:443
125.168.47.127:2222
41.228.22.180:443
181.208.248.227:443
81.215.196.174:443
105.226.83.196:995
176.88.238.122:995
46.107.48.202:443
24.43.99.75:443
172.115.177.204:2222
180.129.102.214:995
2.50.137.197:443
78.87.206.213:995
72.76.94.99:443
66.98.42.102:443
109.228.220.196:443
75.99.168.194:61201
71.13.93.154:2222
45.9.20.200:443
173.174.216.62:443
31.35.28.29:443
93.48.80.198:995
32.221.224.140:995
203.122.46.130:443
47.180.172.159:50010
187.207.48.194:61202
39.44.144.159:995
92.132.172.197:2222
176.205.119.81:2078
144.202.2.175:995
45.76.167.26:995
149.28.238.199:995
45.76.167.26:443
144.202.2.175:443
144.202.3.39:995
45.63.1.12:995
140.82.63.183:995
144.202.3.39:443
149.28.238.199:443
45.63.1.12:443
140.82.63.183:443
63.143.92.99:995
70.46.220.114:443
103.87.95.133:2222
1.161.71.109:995
117.248.109.38:21
180.183.97.165:2222
86.97.11.43:443
202.134.152.2:2222
39.57.23.116:995
91.177.173.10:995
217.128.122.65:2222
24.178.196.158:2222
37.210.164.171:2222
37.186.54.254:995
86.98.208.214:2222
83.110.75.225:2222
174.69.215.101:443
217.165.147.83:993
172.114.160.81:995
84.241.8.23:32103
111.125.245.118:995
120.150.218.241:995
186.64.67.38:443
173.21.10.71:2222
182.191.92.203:995
191.99.191.28:443
73.151.236.31:443
119.158.121.244:995
71.74.12.34:443
101.50.103.193:995
47.158.25.67:443
187.172.232.250:443
47.156.191.217:443
187.250.114.15:443
187.195.19.24:443
201.145.189.252:443
72.252.201.34:990
72.252.201.34:995
45.46.53.140:2222
190.252.242.69:443
187.251.132.144:22
181.62.0.59:443
72.12.115.90:22
103.246.242.202:443
100.1.108.246:443
191.17.223.222:32101
40.134.246.185:995
24.55.67.176:443
109.12.111.14:443
90.120.65.153:2078
179.158.105.44:443
72.252.201.34:993
201.103.199.197:443
37.34.253.233:443
70.51.138.126:2222
187.102.135.142:2222
187.52.231.156:443
86.97.247.20:1194
41.84.242.5:995
186.105.121.166:443
31.48.166.122:2078
89.137.52.44:443
96.29.208.97:443
82.152.39.39:443
85.74.48.5:995
197.205.101.36:443
102.182.232.3:995
86.195.158.178:2222
217.164.210.192:443
197.89.8.167:443
201.211.64.196:2222
196.203.37.215:80
1.161.71.109:443
45.241.232.25:995
175.145.235.37:443
86.98.33.141:995
85.246.82.244:443
43.252.72.97:2222
67.209.195.198:990
41.38.167.179:995
Unpacked files
SH256 hash:
8b3eb1b66e5ae2882ac4581cf3d512fe2013eefa150b897fcf73c885c83a620a
MD5 hash:
8a9347905dc7a332b35a2e680abba535
SHA1 hash:
89f3da9f171b32cbd1bfa7fec7ed6a93c2082206
Link:
https://www.unpac.me/results/4b42d920-f217-402c-91f0-18a801f5d3a1/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/8b3eb1b66e5ae2882ac4581cf3d512fe2013eefa150b897fcf73c885c83a620a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/264008/

Comments