MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1a609c00c3504343f05c5fe6d6353ec177b06551efaf44c4d69e316718dc03e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	a1a609c00c3504343f05c5fe6d6353ec177b06551efaf44c4d69e316718dc03e
SHA3-384 hash:	221f14c3bf5264c03886c7f389c8bae024af8ce727da0d53eb7534a41344f0a96a4c81c6590a1903b172191bb945e934
SHA1 hash:	1baa02f0bb9a63cca913d03c7893846c5622d803
MD5 hash:	c35644ec3d9bcaafb7cf05896a6f5d49
humanhash:	sink-pizza-india-stairway
File name:	111111.png
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	862'136 bytes
First seen:	2020-08-14 18:01:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	6e2d1a858986b89e0247c7a6e45e8001 (1 x Quakbot)
ssdeep	6144:uMhkpTK06/aA6udzpNi1yna2PiQ0erLeROSEGo89QNn/o8S2M1KpWwR+SHvRu4Tr:uMEK06CmNi1L54Z89QNNpJgC5j
Threatray	425 similar samples on MalwareBazaar
TLSH	EE05F100FAA9D00BC6690A784FE6417FB95D9CE57812859731DA3F6DBEF32716C2D00A
Reporter	abuse_ch
Tags:	exe Qakbot qbot Quakbot spx155

abuse_ch

Malspam distributing Quakbot:

HELO: mout-xforward.perfora.net
Sending IP: 82.165.159.133
Subject: Re: Termination of E-mail victim-email Processed Verify Now.
Attachment: 08142020_1955816493.zip (contains "08142020_1955816493.doc")

Quakbot payload URLs:
http://bronco.is/pdniovzkgwwt/111111.png
http://craniotylla.ch/vzufnt/111111.png
http://forum.insteon.com/suowb/111111.png
http://marineworks.eu/dwaunrsamlbq/111111.png
http://nanfeiqiaowang.com/tsxwe/111111.png
http://quickinsolutions.com/wfqggeott/111111.png
http://quoraforum.com/btmlxjxmyxb/111111.png
http://rijschoolfastandserious.nl/rprmloaw/111111.png
http://studiomascellaro.it/wnzzsbzbd/111111.png
http://webtest.pp.ua/yksrpucvx/111111.png

Intelligence

File Origin

# of uploads :

# of downloads :

391

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/46087/

Detection(s):

SecuriteInfo.com.Generic.mg.506e9215326bb8d3.1489.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a process with a hidden window

Creating a file in the Windows subdirectories

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Launching a process

Creating a window

Sending a UDP request

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

68 / 100

Link:

https://www.joesandbox.com/analysis/430587

Signature

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to detect virtual machines (IN, VMware)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Machine Learning detection for sample

Behaviour

Behavior Graph:

Download SVG

Detection:

qakbot

Link:

https://mwdb.cert.pl/sample/a1a609c00c3504343f05c5fe6d6353ec177b06551efaf44c4d69e316718dc03e/

Threat name:

Win32.Trojan.PinkSbot

Status:

Malicious

First seen:

2020-08-14 18:03:05 UTC

AV detection:

41 of 48 (85.42%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=ugtatqamgucdipyfyx7g2y2t5qlxwbsvd35pitcnnhrrm4mnya7a._file

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

trojan banker stealer family:qakbot

Link:

https://tria.ge/reports/200814-y6yfr7js1x/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Executes dropped EXE

Qakbot/Qbot

Malware Config

C2 Extraction:

173.172.205.216:443
66.25.168.167:2222
201.216.216.245:443
75.182.220.196:2222
188.25.26.41:443
213.67.45.195:2222
68.134.181.98:443
68.190.152.98:443
75.183.171.155:995
67.165.206.193:993
75.170.94.218:443
73.137.184.213:443
190.24.177.147:443
188.173.70.18:443
216.146.110.68:443
98.190.24.81:443
209.137.209.163:995
189.210.114.157:443
93.151.180.170:61202
188.26.11.29:2222
186.82.157.66:443
108.46.145.30:443
71.197.126.250:443
175.111.128.234:443
24.71.28.247:443
66.26.160.37:443
71.163.224.206:443
207.255.161.8:993
47.153.115.154:995
72.209.191.27:443
76.170.77.99:995
47.153.115.154:465
100.4.173.223:443
200.75.136.78:443
100.37.36.240:443
93.113.177.152:443
77.27.173.8:995
67.170.137.8:443
108.185.113.12:443
72.28.255.159:995
24.37.178.158:443
207.255.161.8:465
2.90.92.255:443
166.62.180.194:2078
103.238.231.40:443
71.182.142.63:443
71.56.53.127:443
35.134.202.234:443
172.87.134.226:443
73.227.232.166:443
190.77.170.197:2078
79.115.145.90:443
72.240.200.181:2222
72.142.106.198:995
98.11.125.62:443
69.123.179.70:443
187.214.9.138:995
69.11.247.242:443
72.214.55.195:995
189.140.61.205:443
68.174.15.223:443
172.78.30.215:443
68.225.56.31:443
24.234.86.201:995
71.80.66.107:443
96.20.108.17:2222
95.76.185.240:443
173.173.72.199:443
188.51.3.210:995
115.21.224.117:443
209.182.122.217:443
70.164.39.91:443
70.95.118.217:443
24.116.227.63:443
98.4.227.199:443
144.202.48.107:443
2.7.65.32:2222
178.222.12.162:995
75.137.239.211:443
94.59.241.189:995
73.60.148.209:443
73.30.244.90:443
206.51.202.106:50003
70.123.92.175:2222
189.163.82.104:443
182.185.40.22:995
36.230.79.179:443
95.77.144.238:443
187.163.101.137:995
95.77.223.148:443
73.214.248.17:995
189.130.26.216:443
66.57.216.53:993
70.164.37.205:995
24.44.142.213:2222
159.0.126.131:995
72.82.15.220:443
24.122.157.93:443
207.255.161.8:995
186.6.197.11:443
99.231.221.117:443
188.241.159.208:443
2.89.74.34:20
24.46.40.189:2222
68.4.137.211:443
189.183.72.138:995
74.73.120.226:443
86.153.98.126:2222
24.229.150.54:995
134.228.24.29:443
151.205.102.42:443
96.234.20.230:443
96.232.163.27:443
208.93.202.49:443
47.44.217.98:443
45.32.154.10:443
98.240.24.57:443
5.15.65.198:2222
5.193.155.181:2078
80.240.26.178:443
45.77.215.141:443
207.246.71.122:443
67.8.103.21:443
199.247.16.80:443
207.246.75.201:443
49.191.3.234:443
73.228.1.246:443
24.139.132.70:443
76.187.12.181:443
92.59.35.196:2222
50.244.112.10:995
108.27.217.44:443
199.116.241.147:443
24.201.79.208:2078
217.162.149.212:443
59.98.248.254:443
96.41.93.96:443
50.244.112.106:443
78.100.229.44:61201
86.182.234.245:2222
71.126.139.251:443
165.120.230.108:2222
80.195.103.146:2222
89.247.217.163:443
216.201.162.158:443
197.210.96.222:995
117.218.208.239:443
174.80.7.235:443
98.26.50.62:995
199.247.22.145:443

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a1a609c00c3504343f05c5fe6d6353ec177b06551efaf44c4d69e316718dc03e