MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8f7701d2c28e11cab1b101e679722065262dfba823a87fa7d02216a6c5c17d44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8f7701d2c28e11cab1b101e679722065262dfba823a87fa7d02216a6c5c17d44
SHA3-384 hash: 307126303183321df7d2cd0c546fea0d68bf89fd7ca9dc02a16356f7776e61281b8e5ea2c608d5bc5e86fbb45222f661
SHA1 hash: ea1e5e2169cd1bf2e314bc939c98dfa08edac8fd
MD5 hash: 0ea0f15f91b553d2a43169ca12a565c9
humanhash: romeo-oven-asparagus-magazine
File name:44620.6635916667.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:424'960 bytes
First seen:2022-02-28 15:00:36 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
ssdeep 12288:iNtUdcaW57hA9ww7yqktXs1le7Z2WgNncIdVHop:CaINhuwwlktTZ2VOIdVHop
Threatray 68 similar samples on MalwareBazaar
TLSH T1EA94BFB875147DD6E67F477BDA96ACEC03B616229AC7A8CD8064B7C304A3375EE02C05
Reporter pr0xylife
Tags:dll obama160 Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
165
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/245378/
Detection(s):
SecuriteInfo.com.FileRepMalware.5912.14530.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Launching a process
Creating a window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
packed
Link:
https://www.filescan.io/uploads/621ce3bb0cd58dbd92539b58/reports/2ebaaa19-ea68-4761-98ae-4db1fcd332ff/overview
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/2916fbfb-a0b0-4a8c-ab04-a71231663387
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/947480
Signature
Allocates memory in foreign processes
Found malware configuration
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Suspicious Call by Ordinal
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 579967 Sample: 44620.6635916667.dat Startdate: 28/02/2022 Architecture: WINDOWS Score: 92 29 Found malware configuration 2->29 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected Qbot 2->33 35 2 other signatures 2->35 8 loaddll32.exe 1 2->8         started        process3 signatures4 45 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->45 47 Injects code into the Windows Explorer (explorer.exe) 8->47 49 Writes to foreign memory regions 8->49 51 2 other signatures 8->51 11 cmd.exe 1 8->11         started        13 regsvr32.exe 8->13         started        16 rundll32.exe 8->16         started        18 3 other processes 8->18 process5 signatures6 20 rundll32.exe 11->20         started        53 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 13->53 55 Injects code into the Windows Explorer (explorer.exe) 13->55 57 Writes to foreign memory regions 13->57 23 explorer.exe 13->23         started        59 Allocates memory in foreign processes 16->59 61 Maps a DLL or memory area into another process 16->61 25 explorer.exe 16->25         started        process7 signatures8 37 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 20->37 39 Injects code into the Windows Explorer (explorer.exe) 20->39 41 Writes to foreign memory regions 20->41 43 2 other signatures 20->43 27 explorer.exe 8 1 20->27         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8f7701d2c28e11cab1b101e679722065262dfba823a87fa7d02216a6c5c17d44/
Threat name:
Win32.Trojan.QBot
Create hunting rule
Status:
Malicious
First seen:
2022-02-28 15:01:09 UTC
File Type:
PE (Dll)
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
036c25ca8f8bfd424dc22bdacdfc1b1b101afd51fa60391253a757c075b62964
Quakbot
532f5a32f685a1acdb7c0982bb4fd721852af1e9fb278bf5d0faa82a6741f3c8
Quakbot
5f2eabaaf2ee1da8c6e329fe6d8d14961b89dfdad0c8675bbf743cbfe2332cc6
Quakbot
67486db1b558b02235a0a8edaa7183ab707c3c8d12ec87231cd12445856e2398
Quakbot
790951787b259b98ea0f3b7face9c805643bd5e36b2d8a9d92d6d20a7107971b
Quakbot
af9ff6ecb351b6b63446c24677070b767b8f77b0a53feccdfde2c42c1205c258
Quakbot
c1c8bacb9d1cbcef187da4adfde7761c91543e84223a37385fd5c25803e1d16f
Quakbot
d246fc41b6237d49b76bc5e9be5646698558a9b5bcb117e0daf48642d4015b94
Quakbot
ee9aabd2fec3932993038ecf48b2fa192ca5d22c539b5c62be77019a0e77ef79
Quakbot
+ 58 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama160 campaign:1646042914 banker stealer trojan
Link:
https://tria.ge/reports/220228-sdwxkafhar/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
193.253.44.249:2222
38.70.253.226:2222
176.110.96.225:443
41.228.22.180:443
5.88.12.21:443
41.84.247.27:995
144.202.2.175:995
114.79.148.170:443
105.184.116.32:995
78.191.34.56:995
92.177.45.46:2078
82.41.63.217:443
67.209.195.198:443
217.128.122.65:2222
184.100.174.73:443
120.150.218.241:995
32.221.231.1:443
129.208.10.192:995
89.211.185.240:2222
180.233.150.134:995
190.189.33.6:32101
141.237.140.181:995
76.70.9.169:2222
220.129.52.36:443
84.241.8.23:32103
39.49.110.154:995
78.100.194.138:6883
74.15.2.252:2222
136.143.11.232:443
139.228.65.100:2222
209.210.95.228:32100
75.156.151.34:443
96.21.251.127:2222
149.135.101.20:443
31.215.84.57:2222
2.50.41.69:61200
103.139.242.30:990
197.89.109.221:443
190.73.3.148:2222
63.143.92.99:995
185.249.85.209:443
89.101.97.139:443
82.152.39.39:443
144.202.2.175:443
176.67.56.94:443
66.230.104.103:443
47.180.172.159:443
140.82.49.12:443
75.99.168.194:443
47.180.172.159:50010
117.248.109.38:21
2.50.27.78:443
24.178.196.158:2222
39.52.38.109:995
128.106.122.206:443
180.183.100.147:2222
86.98.156.238:993
39.44.124.140:995
197.164.171.102:995
167.86.202.26:443
197.167.46.225:995
47.23.89.60:993
173.174.216.62:443
121.7.223.188:2222
124.41.193.166:443
197.167.46.225:993
93.48.80.198:995
41.43.13.54:995
160.179.145.47:443
182.191.92.203:995
39.41.139.127:995
75.99.168.194:61201
173.21.10.71:2222
102.65.38.67:443
89.137.52.44:443
121.74.187.191:995
45.46.53.140:2222
120.61.3.199:443
58.105.167.35:50000
175.137.153.178:443
71.74.12.34:443
41.13.143.139:443
76.25.142.196:443
208.107.221.224:443
76.69.155.202:2222
73.151.236.31:443
189.253.111.123:995
109.12.111.14:443
86.198.170.170:2222
75.188.35.168:443
105.184.249.182:995
161.142.63.168:443
68.204.7.158:443
86.98.148.18:995
86.139.33.187:443
2.51.171.43:995
101.50.110.176:995
103.230.180.119:443
70.51.153.159:2222
189.146.51.56:443
76.169.147.192:32103
186.64.67.28:443
31.215.70.101:443
41.230.62.211:993
197.240.236.170:443
197.165.161.159:995
81.213.206.182:443
206.217.0.154:995
75.67.194.204:443
191.99.191.28:443
216.46.32.83:443
64.231.96.211:2222
70.57.207.83:443
186.69.101.54:443
72.252.201.34:990
201.103.17.10:443
40.134.247.125:995
47.156.191.217:443
100.1.108.246:443
47.158.25.67:443
67.165.206.193:993
72.252.201.34:993
39.52.196.53:995
72.252.201.34:995
208.101.87.135:443
190.206.211.182:443
31.35.28.29:443
69.14.172.24:443
70.45.27.254:443
69.144.42.24:443
78.101.152.231:61202
196.203.37.215:80
103.116.178.85:443
86.98.11.110:443
98.14.54.50:443
136.232.34.70:443
203.101.178.94:443
89.249.215.26:443
217.164.121.201:2222
111.125.245.118:995
1.161.108.147:995
1.161.108.147:443
41.84.224.185:443
103.87.95.131:2222
78.96.235.245:443
173.220.98.101:443
94.59.58.249:1194
190.200.231.217:61202
Unpacked files
SH256 hash:
678ae5dddb8da3e77c4ff86a5bf115b4fd1365217fef8581fffceebc57267c0c
MD5 hash:
2ac116a6adb2ae86c7687ac372883842
SHA1 hash:
0f53b930cb0457cb5a9e2a09fa5e36b4ed8a173d
Link:
https://www.unpac.me/results/145304bd-ffff-4beb-8083-9d03f5bcb342/
SH256 hash:
8f7701d2c28e11cab1b101e679722065262dfba823a87fa7d02216a6c5c17d44
MD5 hash:
0ea0f15f91b553d2a43169ca12a565c9
SHA1 hash:
ea1e5e2169cd1bf2e314bc939c98dfa08edac8fd
Link:
https://www.unpac.me/results/145304bd-ffff-4beb-8083-9d03f5bcb342/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.61
Link:
https://yomi.yoroi.company/submissions/8f7701d2c28e11cab1b101e679722065262dfba823a87fa7d02216a6c5c17d44

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/245378/

Comments