MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b
SHA3-384 hash:	c11d048323e6f903d72a972b203eaf21f7b59bed6970e787d545bd7fb44a778cd5a132d251266baee4a978c90a84fa42
SHA1 hash:	d59b43c2b7c6c4ff56a50ae1545a045408531710
MD5 hash:	2aadd286af6533008b1b3859b7ea0036
humanhash:	helium-freddie-cup-golf
File name:	0902.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	824'320 bytes
First seen:	2021-02-09 16:44:32 UTC
Last seen:	2021-06-09 20:01:42 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	9c65d6bf258eddd0d27045f5ef3094fc (6 x Quakbot)
ssdeep	24576:wH4nE0l4oqCKzH6s0FaIhAgd/Ia/VKnD:4bqFLKnD
Threatray	110 similar samples on MalwareBazaar
TLSH	AA05AF33B2E14437C17B263D8C2F6AA9A9297E123D389D856BE71D0C4F3A6407D25397
Reporter	lazyactivist192
Tags:	dll Qakbot qbot Quakbot SilentBuilder tr

Intelligence

File Origin

# of uploads :

# of downloads :

286

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/116223/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Modifying an executable file

Creating a process with a hidden window

Sending a custom TCP request

Sending a UDP request

Creating a window

Creating a file in the Windows subdirectories

Launching a process

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b/

Threat name:

Win32.Infostealer.QBot

Status:

Malicious

First seen:

2021-02-09 16:45:13 UTC

AV detection:

19 of 29 (65.52%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tljwtfpwliaujzflwtbbr3253turcbjvhxpy5csoht2xjlb4funq._file

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:tr campaign:1612776124 banker stealer trojan

Link:

https://tria.ge/reports/210209-edk41c4sm6/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Loads dropped DLL

Qakbot/Qbot

Malware Config

C2 Extraction:

176.205.222.30:2078
174.76.188.217:22
105.226.10.142:443
87.202.87.210:2222
203.194.110.74:443
95.77.223.148:443
45.77.115.208:2222
47.146.169.85:443
76.94.200.148:995
23.240.70.80:443
193.252.48.200:443
154.124.130.140:995
45.32.211.207:2222
149.28.98.196:2222
149.28.98.196:995
149.28.101.90:995
207.246.77.75:2222
45.63.107.192:995
173.70.165.101:995
207.246.116.237:995
149.28.99.97:2222
149.28.101.90:8443
207.246.116.237:443
45.77.115.208:443
45.32.211.207:8443
207.246.77.75:8443
149.28.101.90:443
45.63.107.192:2222
207.246.77.75:995
149.28.99.97:995
45.32.211.207:443
144.202.38.185:443
45.63.107.192:443
149.28.101.90:2222
149.28.99.97:443
45.32.211.207:995
207.246.116.237:2222
207.246.116.237:8443
149.28.98.196:443
144.202.38.185:2222
207.246.77.75:443
144.202.38.185:995
1.52.227.184:443
184.189.122.72:443
201.171.77.138:443
208.126.142.17:443
60.50.255.183:443
172.78.30.215:443
171.103.138.122:995
92.59.35.196:2222
176.181.247.197:443
82.127.125.209:990
45.77.115.208:8443
45.77.115.208:995
50.29.166.232:995
172.87.157.235:3389
85.58.200.50:2222
196.151.252.84:443
24.50.118.93:443
103.51.20.143:2222
86.236.77.68:2222
78.63.226.32:443
82.76.47.211:443
76.25.142.196:443
213.60.147.140:443
151.33.233.193:443
81.88.254.62:443
70.126.76.75:443
160.3.187.114:443
41.205.16.1:443
96.61.23.88:995
86.98.93.124:2078
2.232.253.79:995
209.210.187.52:443
188.25.63.105:443
115.133.243.6:443
27.223.92.142:995
140.82.49.12:443
80.11.173.82:8443
2.7.69.217:2222
190.85.91.154:443
142.68.28.22:443
89.211.252.190:995
178.153.37.196:443
79.129.121.81:995
71.88.193.17:443
86.160.137.132:443
202.184.20.119:443
83.110.12.140:2222
115.69.252.0:22
105.198.236.101:443
144.139.47.206:443
105.198.236.99:443
197.45.110.165:995
85.132.36.111:2222
70.168.130.172:995
71.187.170.235:443
80.227.5.69:443
59.90.246.200:443
81.214.126.173:2222
68.225.60.77:995
108.31.15.10:995
83.110.108.181:2222
46.153.119.255:995
216.201.162.158:443
197.161.154.132:443
96.21.251.127:2222
75.136.40.155:443
24.95.61.62:443
68.186.192.69:443
193.248.221.184:2222
75.67.192.125:443
81.97.154.100:443
75.118.1.141:443
47.22.148.6:443
182.48.193.200:443
203.198.96.37:443
106.51.52.111:443
83.110.103.152:443
75.136.26.147:443
2.50.2.216:443
189.223.234.23:995
74.222.204.82:995
173.21.10.71:2222
69.123.179.70:443
71.74.12.34:443
45.46.53.140:2222
86.97.162.85:443
2.51.171.223:443
144.139.166.18:443
71.197.126.250:443
67.6.12.4:443
122.148.156.131:995
64.121.114.87:443
50.244.112.106:443
70.54.25.76:2222
1.32.35.2:443
89.137.211.239:995
67.165.206.193:993
186.28.51.27:443
98.240.24.57:443
109.12.111.14:443
71.14.110.199:443
94.53.92.42:443
84.247.55.190:8443
24.27.82.216:2222
74.68.144.202:443
196.221.207.137:995
85.184.63.112:443
67.8.103.21:443

Unpacked files

SH256 hash:

3a1087161fcd4845a8f94b204d04e4fa21c2f8e2641b25ab863b864a3869e0d5

MD5 hash:

866c4e17cf0a01f8c142b4c436711d1a

SHA1 hash:

1ae8eb502c45f29e1073cccc893269a31aa52dea

Link:

https://www.unpac.me/results/c9087148-823d-412a-a2ab-cedd933eb785/

SH256 hash:

9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b

MD5 hash:

2aadd286af6533008b1b3859b7ea0036

SHA1 hash:

d59b43c2b7c6c4ff56a50ae1545a045408531710

Link:

https://www.unpac.me/results/c9087148-823d-412a-a2ab-cedd933eb785/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9ad36995f65a0144e4abb4c218ef5ddce91105353ddf8e8a4e3cf574ac3c2d1b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QakBot Create hunting rule
Author:	kevoreilly
Description:	QakBot Payload

Rule name:	qbot_bin Create hunting rule
Author:	James_inthe_box
Description:	Qbot Qakbot
Reference:	https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02