MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac435e965d0ac8c246ea9707d9e4545d287879d665479ce3dcfeedc914f25809. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 11


Intelligence 11 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac435e965d0ac8c246ea9707d9e4545d287879d665479ce3dcfeedc914f25809
SHA3-384 hash: 46bad36443610e3079cff771fba7a830bfbdfce0ac67c0259540bba86e295e4785383abc2779c3a810d5471d92e2abab
SHA1 hash: e24ef5bbdf7b2d73e8ad1337a2bd358c506ca8e9
MD5 hash: 2d052c998853edd6186279ee1c96c412
humanhash: lion-arizona-ohio-pluto
File name:822330420929752.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:1'097'200 bytes
First seen:2022-02-15 17:40:55 UTC
Last seen:2022-02-15 19:51:02 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 220ea7972e993d1cdbf761cab8a71a9d (11 x Quakbot)
ssdeep 24576:muwgYKvPteX5lNEZYytPKFYY22OlWc971Zkqtu2K0FCFYB:hzle4Pa122S9k2Ko
Threatray 14 similar samples on MalwareBazaar
TLSH T15C358D3271C1D5BFC4B236BCAD6A71A988257D521D2CCC0DBBD80F4E0D7A691673229E
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter JAMESWT_WT
Tags:dll HOUSE 9A s.r.o Quakbot signed

Code Signing Certificate

Organisation:HOUSE 9A s.r.o
Issuer:Sectigo Public Code Signing CA R36
Algorithm:sha384WithRSAEncryption
Valid from:2021-12-30T00:00:00Z
Valid to:2022-12-30T23:59:59Z
Serial number: d3aee8abb9948844a3ac1c04cc7e6bdf
Intelligence: 10 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: e386450257e170981513b7001a82fb029f0931e5c2f11c6d9b86660da0b89a66
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
159
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/241676/
Detection(s):
SecuriteInfo.com.Trojan.Inject4.25927.19180.2551.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Modifying an executable file
Searching for synchronization primitives
Creating a process with a hidden window
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware overlay packed qbot
Link:
https://www.filescan.io/uploads/620be5b1a2660f3bb9dcda41/reports/46f48ddb-5851-471a-95e7-9f7dcdfeb308/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/13c02a02-5a84-401a-b765-c2bfdbabd319
Result
Threat name:
CryptOne Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/940281
Signature
Allocates memory in foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Schedule system process
Sigma detected: Suspicious Call by Ordinal
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected CryptOne packer
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 572759 Sample: 822330420929752.dll Startdate: 15/02/2022 Architecture: WINDOWS Score: 100 31 Multi AV Scanner detection for dropped file 2->31 33 Multi AV Scanner detection for submitted file 2->33 35 Yara detected CryptOne packer 2->35 37 5 other signatures 2->37 8 loaddll32.exe 1 2->8         started        11 regsvr32.exe 2->11         started        process3 signatures4 39 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->39 41 Injects code into the Windows Explorer (explorer.exe) 8->41 43 Writes to foreign memory regions 8->43 45 2 other signatures 8->45 13 explorer.exe 8 1 8->13         started        17 cmd.exe 1 8->17         started        process5 file6 29 C:\Users\user\Desktop\822330420929752.dll, PE32 13->29 dropped 47 Uses schtasks.exe or at.exe to add and modify task schedules 13->47 19 schtasks.exe 1 13->19         started        21 rundll32.exe 17->21         started        signatures7 process8 process9 23 conhost.exe 19->23         started        25 WerFault.exe 23 9 21->25         started        27 explorer.exe 21->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac435e965d0ac8c246ea9707d9e4545d287879d665479ce3dcfeedc914f25809/
Threat name:
Win32.Infostealer.QBot
Create hunting rule
Status:
Malicious
First seen:
2022-02-15 17:41:11 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
21 of 28 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vrbv5fs5blemerxks4d5tzculuuhq6owmvdzzy6473w4sfhslaeq._file
Verdict:
malicious
Similar samples:
790951787b259b98ea0f3b7face9c805643bd5e36b2d8a9d92d6d20a7107971b
Quakbot
82c0e1fadff42149e37485a8ced86bbc67789ccc953ae5416f04a9aa23d43d1f
Quakbot
c30141d6ee93bea5e69d45f4826a21edf8fc063e38d1b5eb493f1d9ef5aac213
Quakbot
cd8a94e42e7119a3f1b5117151b7bb2fe4a777f221581b2dae0c2cf0e8ddedf2
Quakbot
d0e76eed0972833a1a977725a11aab763374f9f8b31bca82838731a8c3ecc1f2
Quakbot
d8d7d4ffaefc24dae69840816ce840570744f16d54f43fdb73d28e8456483750
Quakbot
e55a662e05fdc1e0c8570564bfcdb0d7cbec3bf5eca101ab12ac2997998c2aa9
Quakbot
e9553ac49999a213ddf6001564a5cb87225f2b5b91cb201c8a415f8dbb1eb623
Quakbot
ee44ca0c691190a878ec0ab55096eeb9855590d9398c95c837c6add9fac2ee32
Quakbot
f7664b0c71230005f8e2390a1bd128b6bae71e4c697d80ddcfe8fa34de8d62a6
Quakbot
+ 4 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama155 campaign:1644912775 banker evasion stealer trojan
Link:
https://tria.ge/reports/220215-v9ez2ahdb9/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Loads dropped DLL
Qakbot/Qbot
Suspicious use of NtCreateProcessExOtherParentProcess
Windows security bypass
Malware Config
C2 Extraction:
32.221.231.1:443
102.65.38.67:443
120.150.218.241:995
39.44.150.120:995
31.215.116.182:2222
217.128.171.34:2222
139.64.13.189:443
95.14.104.242:995
86.98.156.45:993
196.74.174.44:443
89.101.97.139:443
212.34.15.205:443
45.9.20.200:443
75.156.151.34:443
2.50.41.69:61200
31.35.28.29:443
182.191.92.203:995
67.209.195.198:443
37.210.157.12:2222
114.79.148.170:443
96.246.158.154:995
190.73.3.148:2222
41.228.22.180:443
89.86.33.217:443
217.164.115.166:2222
188.50.238.29:995
180.233.150.134:995
89.137.52.44:443
78.87.41.5:995
66.230.104.103:443
24.53.49.240:443
37.211.176.26:61202
1.161.88.84:443
92.177.45.46:2078
24.178.196.158:2222
64.231.96.211:2222
140.82.49.12:443
128.106.122.39:443
31.215.116.182:1194
111.125.245.116:995
39.49.5.42:995
209.210.95.228:32100
181.118.183.28:443
149.135.101.20:443
103.142.10.177:443
86.98.149.75:995
86.98.10.175:995
74.15.2.252:2222
69.14.172.24:443
176.67.56.94:443
1.161.88.84:995
24.222.20.254:443
96.21.251.127:2222
103.17.101.139:995
136.143.11.232:443
76.25.142.196:443
173.21.10.71:2222
71.74.12.34:443
73.151.236.31:443
182.121.70.122:2222
75.67.73.144:443
73.59.201.174:443
70.51.137.204:2222
86.198.170.170:2222
72.252.201.34:995
100.1.108.246:443
67.165.206.193:993
72.252.201.34:990
190.206.211.182:443
78.96.235.245:443
108.4.67.252:443
109.12.111.14:443
70.45.27.254:443
75.188.35.168:443
45.46.53.140:2222
96.37.113.36:993
82.152.39.39:443
41.230.62.211:993
161.142.54.62:443
86.98.49.16:443
38.70.253.226:2222
109.51.132.148:995
76.23.237.163:995
220.255.25.1:2222
82.41.63.217:443
80.14.196.176:2222
86.97.161.184:443
86.98.156.24:32101
184.100.174.73:443
68.204.7.158:443
87.71.79.81:443
218.101.110.3:995
94.60.254.81:443
31.215.206.13:443
24.152.219.253:995
101.50.120.112:995
117.248.109.38:21
78.101.202.183:443
37.177.81.142:995
103.139.242.30:990
201.172.31.135:80
40.134.247.125:995
197.89.20.13:443
113.28.253.9:995
41.86.42.158:995
5.32.41.46:443
78.164.40.62:995
105.184.195.32:995
217.128.93.27:2222
80.6.192.58:443
136.232.34.70:443
182.176.180.73:443
39.52.217.241:995
103.139.242.30:993
75.169.34.158:443
31.215.29.238:443
173.26.188.246:443
41.84.238.71:443
23.82.128.108:443
24.95.61.62:443
144.86.6.161:443
175.137.153.178:443
70.163.1.219:443
31.215.23.29:2222
37.203.225.248:443
193.251.59.245:2222
73.136.32.202:443
86.178.220.77:443
31.215.142.105:2078
73.67.152.98:2222
43.231.252.200:443
41.209.126.246:443
37.186.54.25:995
162.210.220.137:2222
188.50.206.1:995
103.123.225.38:6881
70.50.147.95:2222
72.66.116.235:995
187.191.33.158:443
165.255.54.11:995
31.166.23.80:443
Unpacked files
SH256 hash:
8be4be4646dde16e7cea9d8fee4521e54f61e8de57b7b99f7418d8da36b856a8
MD5 hash:
26f352f58cb4870ce9e6c0fb1f56d71c
SHA1 hash:
6a46ec91496a1f60369df7d6b64082134c8b6d30
Link:
https://www.unpac.me/results/2eed87f0-9804-4981-8a5f-34ebef904bb4/
SH256 hash:
1ebb18839a77e031d0b9edddda065c772e131ff4dea7dd669f5bec28a9f7186b
MD5 hash:
799b025f27586fc43f591fd0983de25d
SHA1 hash:
a05961c16fbe320f0ae5f0dbdfcedbe2017b30ba
Link:
https://www.unpac.me/results/2eed87f0-9804-4981-8a5f-34ebef904bb4/
SH256 hash:
ac435e965d0ac8c246ea9707d9e4545d287879d665479ce3dcfeedc914f25809
MD5 hash:
2d052c998853edd6186279ee1c96c412
SHA1 hash:
e24ef5bbdf7b2d73e8ad1337a2bd358c506ca8e9
Link:
https://www.unpac.me/results/2eed87f0-9804-4981-8a5f-34ebef904bb4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ac435e965d0ac8c246ea9707d9e4545d287879d665479ce3dcfeedc914f25809

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/241676/

Comments