MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99f851b8bb921318568a9c87ef39bc353c0e3c9af67a8f5078e957f4bb046491. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	99f851b8bb921318568a9c87ef39bc353c0e3c9af67a8f5078e957f4bb046491
SHA3-384 hash:	fa82fe41f27ef131ce054baa019a17e03fecfb12f2c36b238001d20d5156ffbda47245b7a7b1e1fd4ab3d31c2316bd69
SHA1 hash:	e0bf840043d0fb621608e12910f7575d6306caa5
MD5 hash:	ecbdc762e9dafb05df850145a6cbc875
humanhash:	oxygen-neptune-sink-leopard
File name:	1597161079.png
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	509'944 bytes
First seen:	2020-08-11 13:52:40 UTC
Last seen:	2020-08-11 16:59:29 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	d5a36bb3349a6c111632bd2766d97313 (6 x Quakbot)
ssdeep	12288:uBsdTiUyExNxkdxNxwyxNxQxNxwrvE05exl0DPAs+gm/CQlzsOaIWaPaK888888l:v7yHrvE6eT0DzJm/CQJsOahr2
Threatray	435 similar samples on MalwareBazaar
TLSH	C9B4D052A3EB0072F6F9463D887B94609D363D65B6E1CA9F7D70F54E18702D248F2B22
Reporter	abuse_ch
Tags:	exe Qakbot Quakbot spx152

abuse_ch

Malspam distributing Quakbot:

HELO: premium75-2.web-hosting.com
Sending IP: 198.187.31.225
From: <anum@tesla-pv.com>
Subject: Re: A Biblical Option to Rising Healthcare Costs
Attachment: Complaint_233.zip (contains "Complaint_233.doc")

Quakbot payload URL:
http://denibhelpme.com/pncciwm/1597161079.png

Intelligence

File Origin

# of uploads :

# of downloads :

213

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/43460/

Detection(s):

SecuriteInfo.com.Backdoor.Win32.QAKBOT.SMF.21319.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a process with a hidden window

Creating a file in the Windows subdirectories

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Launching a process

Creating a window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

64 / 100

Link:

https://www.joesandbox.com/analysis/419127

Signature

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to detect virtual machines (IN, VMware)

Detected potential unwanted application

Detected unpacking (changes PE section rights)

Machine Learning detection for sample

Behaviour

Behavior Graph:

Download SVG

Detection:

qakbot

Link:

https://mwdb.cert.pl/sample/99f851b8bb921318568a9c87ef39bc353c0e3c9af67a8f5078e957f4bb046491/

Threat name:

Win32.Backdoor.Quakbot

Status:

Malicious

First seen:

2020-08-11 13:54:06 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=th4fdof3sijrqvuktsd66on4gu6a4pe26z5i6udy5fl7joyemsiq._file

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

trojan banker stealer family:qakbot

Link:

https://tria.ge/reports/200811-g35yfnycyx/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Executes dropped EXE

Qakbot/Qbot

Malware Config

C2 Extraction:

72.214.55.195:995
108.30.125.94:443
24.122.228.88:443
100.4.173.223:443
95.77.223.148:443
185.19.190.81:443
67.170.137.8:443
134.0.196.46:995
71.163.224.206:443
24.37.178.158:443
81.133.234.36:2222
197.37.252.37:993
190.31.192.87:443
103.238.231.40:443
35.134.202.234:443
174.82.131.155:995
189.130.26.216:443
172.78.30.215:443
200.124.231.21:443
47.146.32.175:443
12.5.37.3:995
144.139.47.206:443
165.228.200.94:443
24.46.40.189:2222
216.201.162.158:443
95.76.31.12:443
50.244.112.10:995
95.77.144.238:443
41.228.203.182:443
109.154.214.242:2222
24.201.79.208:2078
67.87.48.38:443
117.242.253.123:443
41.36.55.195:995
78.100.229.44:61201
96.20.108.17:2222
68.174.15.223:443
173.173.72.199:443
115.21.224.117:443
70.95.118.217:443
24.116.227.63:443
24.234.86.201:995
201.216.216.245:443
70.164.39.91:443
73.23.194.75:443
35.209.218.146:443
45.32.155.12:443
68.204.164.222:443
5.15.65.198:2222
45.32.154.10:443
66.26.160.37:443
172.116.85.178:443
104.235.94.155:443
173.90.33.182:2222
2.51.240.61:995
72.28.255.159:995
83.110.92.29:443
94.52.160.116:443
178.80.92.60:443
209.59.86.206:20
2.89.74.34:20
141.158.47.123:443
82.79.67.68:443
39.118.245.6:443
71.187.170.235:443
188.15.173.34:995
78.96.199.79:443
166.62.180.194:2078
98.243.187.85:443
50.244.112.106:443
210.195.174.114:443
200.84.244.33:2078
188.247.252.243:443
74.129.24.163:443
78.100.192.173:443
90.68.84.121:2222
144.202.48.107:443
45.77.215.141:443
5.13.189.91:443
73.228.1.246:443
70.126.76.75:443
92.59.35.196:2222
5.13.102.138:995
47.44.217.98:443
98.26.50.62:995
65.131.38.205:995
67.209.195.198:443
118.160.163.65:443
200.75.136.78:443
117.218.208.239:443
102.190.213.116:443
100.37.36.240:443
77.27.173.8:995
203.198.96.59:443
75.137.239.211:443
213.120.109.73:2222
76.170.77.99:995
96.255.188.58:443
72.183.129.56:443
98.173.34.212:995
73.140.88.255:443
47.153.115.154:465
76.187.12.181:443
37.106.112.141:443
31.5.21.66:443
86.98.70.252:995
68.190.152.98:443
67.165.206.193:993
2.50.58.159:443
75.183.171.155:995
98.190.24.81:443
86.98.89.9:2222
68.14.210.246:22
93.151.180.170:61202
47.206.174.82:443
66.215.32.224:443
217.165.164.57:2222
24.44.142.213:2222
72.82.15.220:443
96.227.127.13:443
86.126.218.134:443
95.221.48.169:2222
197.165.161.55:995
72.190.101.70:443
207.255.18.67:443
176.205.255.97:443
2.89.74.34:995
96.37.113.36:993
5.193.178.241:2078
98.219.77.197:443
24.28.183.107:995
75.110.250.89:995
47.28.131.209:443
66.30.92.147:443
188.51.3.210:995
71.126.139.251:443
217.165.112.13:995
98.4.227.199:443
94.59.241.189:995
199.247.16.80:443
195.138.42.49:50001
80.240.26.178:443
68.225.56.31:443
2.89.74.34:21
85.186.233.237:443
66.222.88.126:995
86.98.153.155:443
197.210.96.222:995
39.36.132.214:995
101.108.13.129:443

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.67

Link:

https://yomi.yoroi.company/submissions/99f851b8bb921318568a9c87ef39bc353c0e3c9af67a8f5078e957f4bb046491