MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ef5f5a55db078bbcf60cb9750349ab35f3ef88e8c5574f23fb77a485d0ba603. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 12


Intelligence 12 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9ef5f5a55db078bbcf60cb9750349ab35f3ef88e8c5574f23fb77a485d0ba603
SHA3-384 hash: f25be21f3cf35308bb54fc7b76ee9c276837f573907707d58f11555170717fb9f49f965ada6b43a49f16f05b8c433f8d
SHA1 hash: 7d831da7bd7aa594b4efa0f07ea9ee0748fdb9cb
MD5 hash: f6f4f1bbe873a35bdfffffc0c00b61af
humanhash: beryllium-sad-fix-floor
File name:9e.dll
Download: download sample
Signature Quakbot
Create hunting rule
File size:395'776 bytes
First seen:2022-10-11 14:22:11 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 3c85ad0d25a101f6044357c668da2423 (4 x Quakbot)
ssdeep 6144:XtgTFlqteWTBa5WsoUReNsyLK998WqniKS9jyA9yjHHXsBcfmL/p+LIORL6qYFYM:d8z4TU5WsoURzN92tniPHlQEFYM
Threatray 1'515 similar samples on MalwareBazaar
TLSH T17D842C87ED54DFBBC6BD81B9AA5E069F821242167F4336EB621D4190B58374333E638C
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter 0x746f6d6669
Tags:dll Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
204
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318985/
Detection(s):
Win.Malware.Botx-9973723-0
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Modifying an executable file
Creating a window
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
kbot qakbot qbot
Link:
https://www.filescan.io/uploads/63457c4833e66132ed02ada8/reports/3318c5f9-0b10-46ed-8d49-3bdc8661da12/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6c499ba3-96aa-4896-a11a-08b7829f6a2a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9ef5f5a55db078bbcf60cb9750349ab35f3ef88e8c5574f23fb77a485d0ba603/
Threat name:
Win32.Trojan.BotX
Create hunting rule
Status:
Malicious
First seen:
2022-10-08 01:11:05 UTC
File Type:
PE (Dll)
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t327ljk5wb4lxt3azolvane2wnpt56eorrkxj4r7w55eqxiluybq._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
305a3a87057732de16ae881a69182e79a84d5c5054d038e1c1cab3de4518c25c
Quakbot
3f3efd6c40d562ef37c921c7aa9e710c743638acc2d16580e1a560060142fc68
Quakbot
470754664a7e32f09d0ce3b5d17446aaaa9363f3d4d387fe272e2435851a351e
Quakbot
7777f5f15907b512286ed4758a02048a6674ad1b3d5056b866c4c823807dc6fc
Quakbot
7d9d70bdc53de103086dfc901004cfa2dc93fb25fb5c40109b63ba071107e40a
Quakbot
efd8c729d110e2374f5b445d501162fb8d798611aff72608e8bf86efaf092486
Quakbot
+ 1'505 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/221011-rp47mshhbk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
78.94.148.92:1753
134.180.185.240:32987
201.136.101.182:38323
124.77.95.5:46163
196.90.29.190:30693
187.144.110.117:36330
10.44.33.140:65267
162.117.200.91:29984
159.254.223.192:31154
11.239.81.233:37
31.248.76.23:24072
224.77.182.18:55579
124.230.27.11:44408
205.255.39.94:54675
192.1.213.104:14212
145.3.120.239:20068
242.199.30.106:9157
243.240.195.106:42825
74.234.32.185:42698
102.51.5.67:47820
43.190.241.127:50708
29.119.168.182:51370
54.106.172.208:21101
76.55.174.209:2746
71.182.193.130:5327
111.143.132.167:9985
173.210.161.232:27188
22.155.219.162:29117
167.159.67.2:42455
80.214.112.151:9618
75.86.4.24:35165
106.146.239.56:49679
194.127.196.112:59762
64.184.233.29:48193
218.86.11.123:62100
108.87.254.103:36138
240.129.151.227:4400
96.117.66.72:0
48.220.224.248:32917
240.164.22.246:57048
224.87.85.180:40164
214.9.213.13:12523
117.180.92.184:46633
73.23.253.56:17393
162.74.55.118:4571
9.252.189.253:60714
101.200.152.191:46287
110.117.95.0:0
Unpacked files
SH256 hash:
015333067ef2ebae50016173606cec293646aa65618df0ff18b33c0fb9710127
MD5 hash:
0bf5166650701c78aa26f03b4b398abd
SHA1 hash:
e9bed7768ac9730a2c57b7576c2fcfbc357b0a8d
Detections:
Qakbot
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/44218193-ca07-4790-9307-3be09e6a42c3/
SH256 hash:
9ef5f5a55db078bbcf60cb9750349ab35f3ef88e8c5574f23fb77a485d0ba603
MD5 hash:
f6f4f1bbe873a35bdfffffc0c00b61af
SHA1 hash:
7d831da7bd7aa594b4efa0f07ea9ee0748fdb9cb
Link:
https://www.unpac.me/results/44218193-ca07-4790-9307-3be09e6a42c3/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9ef5f5a55db0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/9ef5f5a55db078bbcf60cb9750349ab35f3ef88e8c5574f23fb77a485d0ba603

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:unpacked_qbot
Create hunting rule
Description:Detects unpacked or memory-dumped QBot samples
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.
Rule name:win_qakbot_malped
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/318985/

Comments