MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9457a1ad7aef20eae672a7e3fb51d6904a72df826e810c5aa30dde9e1b68cb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9457a1ad7aef20eae672a7e3fb51d6904a72df826e810c5aa30dde9e1b68cb0
SHA3-384 hash: 0b6080796adaf636bfe12de47712ca0cd6e4094f4023acfcdf159e9c65cfb293cddcd94ac4f7f5bfb45b9837e55e4601
SHA1 hash: 4478b0c7d641a2c67bbd040ae19a59b7a1d2b485
MD5 hash: a5c8870f3c8c0d933420f04e24b6bbdf
humanhash: arkansas-india-july-sierra
File name:a5c8870f3c8c0d933420f04e24b6bbdf.dll
Download: download sample
Signature Quakbot
Create hunting rule
File size:482'835 bytes
First seen:2021-09-30 15:18:22 UTC
Last seen:2021-09-30 16:19:43 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dbb12093152dfc1c3e7222c20da35af3 (4 x Quakbot)
ssdeep 12288:Sm/vYhQYM37FtcPdXcYU/PSi0ouri3YbRTx4Psc:V/QhQPxUUPSi0trYYbRTxWsc
Threatray 193 similar samples on MalwareBazaar
TLSH T1FEA45C403A59E915E6A95A368F5AE4EC07487D08DFB9708F78E03F0F3A7A493C625317
Reporter abuse_ch
Tags:dll Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/193716/
Detection(s):
SecuriteInfo.com.Variant.Babar.28762.19009.29902.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a window
Launching the default Windows debugger (dwwin.exe)
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/e1ce2693-3990-4f3a-ad36-ba0027cf761b
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/862026
Signature
Allocates memory in foreign processes
Found malware configuration
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Regsvr32 Command Line Without DLL
Sigma detected: Schedule system process
Uses cmd line tools excessively to alter registry or file data
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 494453 Sample: 1GiSQPm8Jk.dll Startdate: 30/09/2021 Architecture: WINDOWS Score: 100 59 Found malware configuration 2->59 61 Multi AV Scanner detection for submitted file 2->61 63 Yara detected Qbot 2->63 65 3 other signatures 2->65 9 loaddll32.exe 1 2->9         started        12 regsvr32.exe 2->12         started        14 regsvr32.exe 2->14         started        process3 signatures4 77 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 9->77 79 Injects code into the Windows Explorer (explorer.exe) 9->79 81 Maps a DLL or memory area into another process 9->81 16 cmd.exe 1 9->16         started        18 rundll32.exe 9->18         started        21 rundll32.exe 9->21         started        27 2 other processes 9->27 23 regsvr32.exe 12->23         started        25 regsvr32.exe 14->25         started        process5 signatures6 29 rundll32.exe 16->29         started        67 Allocates memory in foreign processes 18->67 69 Maps a DLL or memory area into another process 18->69 32 explorer.exe 18->32         started        34 explorer.exe 21->34         started        71 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 23->71 73 Injects code into the Windows Explorer (explorer.exe) 23->73 75 Writes to foreign memory regions 23->75 36 explorer.exe 8 2 23->36         started        39 schtasks.exe 1 27->39         started        41 explorer.exe 27->41         started        process7 file8 83 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 29->83 85 Injects code into the Windows Explorer (explorer.exe) 29->85 87 Writes to foreign memory regions 29->87 93 2 other signatures 29->93 43 explorer.exe 29->43         started        89 Uses schtasks.exe or at.exe to add and modify task schedules 34->89 57 C:\Users\user\Desktop\1GiSQPm8Jk.dll, PE32 36->57 dropped 91 Uses cmd line tools excessively to alter registry or file data 36->91 45 reg.exe 1 1 36->45         started        47 reg.exe 1 1 36->47         started        49 conhost.exe 36->49         started        51 conhost.exe 39->51         started        signatures9 process10 process11 53 conhost.exe 45->53         started        55 conhost.exe 47->55         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9457a1ad7aef20eae672a7e3fb51d6904a72df826e810c5aa30dde9e1b68cb0/
Threat name:
Win32.Trojan.Babar
Create hunting rule
Status:
Malicious
First seen:
2021-09-30 14:44:12 UTC
AV detection:
12 of 28 (42.86%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
gozi
Create hunting rule
Similar samples:
05bd9cbf9725884979435d684a7268a75eb05d5916dc85325b0286e9ed71a038
Quakbot
0d1850712e82653dc7112d8bdae533b898a68f696c9b66dfe8f93120f73af191
Quakbot
18031a450fceb7fc4d66d734460db85af52b5a195c2338cf5aebe3aa4f11e9c4
Quakbot
241e148a3dbbe5e0032079887d3b714128736a3d5ba3f5fc253d7805d8349925
Quakbot
3db836aa01204f3f894360b086384595b480b8c45472f97214d1676091851c9f
Quakbot
8d2418d362dfacdb5efdf08a6c3a7f5e8f279670633676333f0466ff8158e5ff
Quakbot
b194eec1e599feeadfd463b06727e8b3c73a72a4c20017e5cfaf89fbf6d365c7
Quakbot
c391f6bceacdfa48e878abfb75609d726be48e84e7663a4a68b9f5162ce8f298
Quakbot
cf0c686564c106b2da71b916c7d022e77894c6dd48e5dc8fec000254def55f11
Quakbot
f45a72880d244adbc4e7d41517e790b291ca235c7655f887d5eed31373516abb
Quakbot
+ 183 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:tr campaign:1632817399 banker evasion stealer trojan
Link:
https://tria.ge/reports/210930-sp6k5sabdl/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
120.151.47.189:443
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
76.25.142.196:443
181.118.183.94:443
120.150.218.241:995
185.250.148.74:443
95.77.223.148:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
105.157.55.133:995
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
Unpacked files
SH256 hash:
adfddd2ff466bc1b7d1c1023204157b82c3fd4833be10fb764c9307ff9754591
MD5 hash:
a8abdab4f9b2fd086ccde4fd0fee185f
SHA1 hash:
8f9fb7afd3eed103d928a3eb5b5c0079ed8e38c8
Link:
https://www.unpac.me/results/c214b4b9-710e-46f7-b2da-61af5d480366/
SH256 hash:
a9457a1ad7aef20eae672a7e3fb51d6904a72df826e810c5aa30dde9e1b68cb0
MD5 hash:
a5c8870f3c8c0d933420f04e24b6bbdf
SHA1 hash:
4478b0c7d641a2c67bbd040ae19a59b7a1d2b485
Link:
https://www.unpac.me/results/c214b4b9-710e-46f7-b2da-61af5d480366/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a9457a1ad7aef20eae672a7e3fb51d6904a72df826e810c5aa30dde9e1b68cb0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

DLL dll a9457a1ad7aef20eae672a7e3fb51d6904a72df826e810c5aa30dde9e1b68cb0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1649077/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/193716/

Comments