MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 adb88494e762ab691988b60a10c6b7f8cf3c921f878a189e9a468ee4cf059820. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: adb88494e762ab691988b60a10c6b7f8cf3c921f878a189e9a468ee4cf059820
SHA3-384 hash: 6b24f473f24d3fff58bddb3a56eb4f4c1c5d75ea4ed1079d42780702e85fa823eaba1576447b5fa3e08fddbe9a16f056
SHA1 hash: 6a24e86e62ce623396a779f4ef9478785f1af852
MD5 hash: 842f4cc5375cfdc580250bb3ed1793a8
humanhash: fanta-purple-william-shade
File name:a2t7KN.tmp
Download: download sample
Signature Quakbot
Create hunting rule
File size:569'344 bytes
First seen:2021-02-02 00:22:02 UTC
Last seen:2021-02-02 01:29:48 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 515161a0eb0fab8f91697d25293b1c66 (9 x Quakbot)
ssdeep 12288:XYVmN8QDv7Uaz2Y7vNTUaF7AZnKJaiuG3q2ebcfk4P:IIiQvU0vzVAZ+aiD3q2e0
Threatray 70 similar samples on MalwareBazaar
TLSH 51C4D1B9754085E5CD914078E82CF7A8D89DBDE78E10E25372FB3E4F7A3E891C451A0A
Reporter malware_traffic
Tags:dll Qakbot qbot Quakbot Shathak TA551


Avatar
malware_traffic
run method: regsvr32.exe [filename]

Intelligence

File Origin
# of uploads :
2
# of downloads :
224
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/115048/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a custom TCP request
Creating a file in the Windows subdirectories
Launching a process
Modifying an executable file
Creating a process with a hidden window
Sending a UDP request
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/adb88494e762ab691988b60a10c6b7f8cf3c921f878a189e9a468ee4cf059820/
Threat name:
Win32.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-02 00:22:12 UTC
AV detection:
7 of 45 (15.56%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78
Quakbot
3a3c6a24c92122aed7b59bbf11bb4dd3336f8d8c4cac465019b378c413115b4b
Quakbot
5341bfaa036572962203ee9cf560ee20acbf258a91460c5532e4372df4c5c643
Quakbot
56b00ad268437ab13a1f697139503ae499204e0057acc002768c1f69db25a049
Quakbot
59face6793dba844768077f3d8aa46b10b67245d0d7c8f6b42c19d80e48ab63a
Quakbot
ce2ce903d184097c4f499384a81de2ede73ef9cd75ce6e4195eec0adfe2c0a27
Quakbot
e2f918cc280e13a42b676094f818b747c8a6d99222b4adab44f4b8ed1f34e0c0
Quakbot
ee4ff414653f3118f31958366a0f7c891c5a7362bd8fb1ece6ffd908ab425113
Quakbot
f3feb8d547565871d9fbc105082bbc6d50466a9fb2e3da5131d267010c48ad86
Quakbot
f540357d1b588091c99f739171e8846fb604a5ee0f9a3dd776f5584c023cb4a3
Quakbot
+ 60 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:krk01 campaign:1611569149 banker stealer trojan
Link:
https://tria.ge/reports/210202-7b8apdy946/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Malware Config
C2 Extraction:
31.5.21.66:995
89.3.198.238:443
202.188.138.162:443
188.24.128.253:443
175.141.219.71:443
151.60.15.183:443
184.189.122.72:443
80.227.5.70:443
140.82.49.12:443
89.211.241.100:995
81.97.154.100:443
77.27.174.49:995
92.154.83.96:2078
42.3.8.54:443
71.187.170.235:443
46.153.36.53:995
71.182.142.63:443
105.186.102.16:443
50.244.112.106:443
78.63.226.32:443
85.132.36.111:2222
68.186.192.69:443
75.136.40.155:443
68.225.60.77:995
144.139.47.206:443
79.129.121.81:995
98.121.187.78:443
75.67.192.125:443
216.201.162.158:443
2.50.2.216:443
75.136.26.147:443
84.72.35.226:443
172.78.30.215:443
105.198.236.99:443
83.110.102.100:443
193.248.221.184:2222
190.85.91.154:443
96.37.113.36:993
83.110.108.181:2222
88.233.91.244:443
95.77.223.148:443
207.246.77.75:2222
86.236.77.68:2222
207.246.77.75:443
45.63.107.192:995
77.211.30.202:995
149.28.99.97:443
207.246.77.75:8443
149.28.98.196:2222
207.246.116.237:995
207.246.116.237:8443
149.28.99.97:995
207.246.77.75:995
207.246.116.237:2222
45.77.115.208:443
45.32.211.207:995
149.28.101.90:8443
149.28.101.90:443
149.28.99.97:2222
172.115.177.204:2222
144.202.38.185:995
207.246.116.237:443
149.28.98.196:443
144.202.38.185:443
149.28.101.90:995
45.32.211.207:2222
45.32.211.207:443
45.32.211.207:8443
149.28.98.196:995
144.202.38.185:2222
45.63.107.192:443
149.28.101.90:2222
45.63.107.192:2222
45.77.115.208:2222
196.151.252.84:443
105.198.236.101:443
82.76.47.211:443
45.77.115.208:995
45.77.115.208:8443
213.60.147.140:443
92.59.35.196:2222
47.22.148.6:443
203.106.195.67:443
202.185.50.15:443
173.70.165.101:995
50.240.77.238:22
86.98.93.124:2078
172.87.157.235:3389
197.45.110.165:995
76.25.142.196:443
106.51.52.111:443
188.25.63.105:443
83.110.12.140:2222
64.121.114.87:443
50.29.166.232:995
217.133.54.140:32100
122.148.156.131:995
173.21.10.71:2222
45.46.53.140:2222
67.6.91.75:443
47.156.65.184:443
76.111.128.194:443
75.118.1.141:443
65.27.228.247:443
71.74.12.34:443
74.68.144.202:443
98.240.24.57:443
47.196.192.184:443
71.14.110.199:443
71.197.126.250:443
24.253.38.139:993
197.161.154.132:443
80.7.129.64:995
47.208.8.187:443
89.137.211.239:995
86.220.60.133:2222
94.53.92.42:443
78.97.207.104:443
106.250.150.98:443
67.8.103.21:443
41.39.134.183:443
2.50.161.6:2222
96.19.117.140:443
199.19.117.131:443
104.37.20.207:995
216.150.207.100:2222
189.222.111.204:443
73.216.60.90:2222
69.123.179.70:443
189.237.7.9:443
89.137.221.232:443
109.12.111.14:443
125.63.101.62:443
2.7.69.217:2222
89.211.247.202:443
201.130.149.43:995
186.155.151.167:443
201.127.37.219:443
151.205.102.42:443
189.210.115.207:443
97.69.160.4:2222
72.240.200.181:2222
72.252.201.69:443
172.87.134.226:995
209.210.187.52:995
209.210.187.52:443
108.46.145.30:443
24.229.150.54:995
186.84.90.232:443
80.11.5.65:2222
Unpacked files
SH256 hash:
772f54ffd1ef1896a3446e1d68b3c162a0fd5361560d5436f252ee4f2bc8d6fa
MD5 hash:
1e42493dd981f496ff0d40c60b52bc6a
SHA1 hash:
3eedb1c84d98619d452ba75bf3946ef34f00cc42
Link:
https://www.unpac.me/results/aed83f6a-a310-45e8-846f-4a5aa1bed16e/
SH256 hash:
adb88494e762ab691988b60a10c6b7f8cf3c921f878a189e9a468ee4cf059820
MD5 hash:
842f4cc5375cfdc580250bb3ed1793a8
SHA1 hash:
6a24e86e62ce623396a779f4ef9478785f1af852
Link:
https://www.unpac.me/results/aed83f6a-a310-45e8-846f-4a5aa1bed16e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
ursnif3
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/adb88494e762ab691988b60a10c6b7f8cf3c921f878a189e9a468ee4cf059820

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:qbot_bin
Create hunting rule
Author:James_inthe_box
Description:Qbot Qakbot
Reference:https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/115048/

Comments