MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 adfb44cb8a94a4e666e7a467d3ff9885d4fb81bbb6f08181f62b1ad3b2545ccc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 10

Intelligence 10 IOCs YARA File information Comments 1

SHA256 hash:	adfb44cb8a94a4e666e7a467d3ff9885d4fb81bbb6f08181f62b1ad3b2545ccc
SHA3-384 hash:	c236059c694e4e9d0c3bb1bb8ef2fc3b213a5f3222ec528864fa15b2e5243386edad8f8908fe8efd0bb3cc58cfa129a9
SHA1 hash:	6eba4a791a4709ba78d533457f3d504ef1e88523
MD5 hash:	f3d31016fc9af7b2993b12949c2dbaad
humanhash:	maryland-kitten-georgia-illinois
File name:	f3d31016fc9af7b2993b12949c2dbaad.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	1'107'229 bytes
First seen:	2021-05-05 13:19:37 UTC
Last seen:	2021-05-05 14:03:23 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	c9aa71f9d0787376868231a1c3f50927 (9 x Quakbot)
ssdeep	24576:4Z9vIZJjL3ILLHIxKe075d0ecmDnaSXH6NcLVXrzICEh:4ZUgLHIoj+0rz0
Threatray	1'370 similar samples on MalwareBazaar
TLSH	F7359F73F2E24837D4372A796C7B5758AC39BE106A28B8463FE91D4C5F396803D25293
Reporter	abuse_ch
Tags:	dll Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

109

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/150622/

Detection(s):

SecuriteInfo.com.Trojan.Inject4.10782.5951.25057.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Launching a process

Modifying an executable file

Creating a process with a hidden window

Creating a window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

qbot

Link:

https://mwdb.cert.pl/sample/adfb44cb8a94a4e666e7a467d3ff9885d4fb81bbb6f08181f62b1ad3b2545ccc/

Threat name:

Win32.Trojan.QBot

Status:

Malicious

First seen:

2021-05-05 13:20:11 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:tr campaign:1618492267 banker stealer trojan

Link:

https://tria.ge/reports/210505-ww6vxdhvye/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

Loads dropped DLL

Qakbot/Qbot

Malware Config

C2 Extraction:

151.205.102.42:443
136.232.34.70:443
216.201.162.158:443
47.196.192.184:443
67.8.103.21:443
140.82.49.12:443
24.226.156.153:443
71.41.184.10:3389
24.139.72.117:443
71.74.12.34:443
24.55.112.61:443
173.21.10.71:2222
193.248.221.184:2222
105.198.236.99:443
78.63.226.32:443
45.63.107.192:443
149.28.98.196:443
144.202.38.185:443
149.28.101.90:995
45.32.211.207:443
24.229.150.54:995
149.28.98.196:995
149.28.98.196:2222
45.77.115.208:443
45.77.115.208:995
45.77.115.208:2222
45.77.115.208:8443
207.246.116.237:443
207.246.116.237:995
45.77.117.108:2222
45.77.117.108:443
45.77.117.108:995
45.77.117.108:8443
45.32.211.207:995
45.32.211.207:8443
45.32.211.207:2222
149.28.99.97:995
149.28.99.97:443
45.63.107.192:2222
144.202.38.185:2222
144.202.38.185:995
149.28.101.90:443
149.28.101.90:8443
149.28.101.90:2222
207.246.77.75:443
207.246.77.75:8443
207.246.77.75:995
207.246.116.237:8443
207.246.77.75:2222
207.246.116.237:2222
105.198.236.101:443
81.97.154.100:443
47.22.148.6:443
45.63.107.192:995
149.28.99.97:2222
188.26.91.212:443
115.133.243.6:443
76.25.142.196:443
45.46.53.140:2222
73.151.236.31:443
75.118.1.141:443
67.165.206.193:993
98.252.118.134:443
186.31.46.121:443
189.210.115.207:443
72.252.201.69:443
72.240.200.181:2222
75.137.47.174:443
109.12.111.14:443
98.192.185.86:443
86.190.41.156:443
27.223.92.142:995
24.117.107.120:443
108.14.4.202:443
75.67.192.125:443
24.43.22.221:993
190.85.91.154:443
86.220.62.251:2222
71.163.222.243:443
97.69.160.4:2222
90.65.236.181:2222
73.25.124.140:2222
24.152.219.253:995
71.187.170.235:443
197.45.110.165:995
50.244.112.106:443
96.61.23.88:995
50.29.166.232:995
95.77.223.148:443
94.59.106.186:2078
83.110.109.164:2222
64.121.114.87:443
144.139.47.206:443
96.37.113.36:993
222.153.174.162:995
172.78.56.208:443
77.27.207.217:995
24.95.61.62:443
77.211.30.202:995
92.59.35.196:2222
106.51.52.111:995
184.189.122.72:443
195.12.154.8:443
68.186.192.69:443
75.136.40.155:443
71.117.132.169:443
96.21.251.127:2222
71.199.192.62:443
70.168.130.172:995
83.196.56.65:2222
209.126.88.81:2222
82.12.157.95:995
209.210.187.52:995
209.210.187.52:443
67.6.12.4:443
189.222.59.177:443
174.104.22.30:443
142.117.191.18:2222
189.146.183.105:443
213.60.147.140:443
196.221.207.137:995
108.46.145.30:443
187.250.238.164:995
2.7.116.188:2222
195.43.173.70:443
106.250.150.98:443
45.67.231.247:443
83.110.103.152:443
83.110.9.71:2222
78.97.207.104:443
59.90.246.200:443
80.227.5.69:443
125.63.101.62:443
86.236.77.68:2222
109.106.69.138:2222
84.72.35.226:443
217.133.54.140:32100
197.161.154.132:443
89.137.211.239:995
74.222.204.82:995
122.148.156.131:995
156.223.110.23:443
144.139.166.18:443
202.185.166.181:443
76.94.200.148:995
71.63.120.101:443
196.151.252.84:443
202.188.138.162:443
74.68.144.202:443
69.58.147.82:2078

Unpacked files

SH256 hash:

55fe7b994534db16567a21f5b40fb05369c61d594ff2457e0eac8df0116b935f

MD5 hash:

b305705014021387576637eb960dbd41

SHA1 hash:

c2ec4c1b5a1de8c56825869951ac1a6a74645449

Detections:

win_qakbot_auto

Link:

https://www.unpac.me/results/a266746d-aacb-4985-8f9c-db8dbe2c04b2/

Parent samples :

800b599cd553bef6b90c76c70a428eff132c90c825ece59cd65c80d36400fb66
3782d5314ef9f22581067ef42c9e924dd8ed421b16d3a80dcde3c1e6abce5f71
adfb44cb8a94a4e666e7a467d3ff9885d4fb81bbb6f08181f62b1ad3b2545ccc
94a060809035633e32cfb6251b9bc65c557ffb3bf6ec7b8accfb35770c052644
2ee8543b75bdab6cdc192a5a91e1bd8dfe6906b2e13bc4406c3d05f86d6ecedb

SH256 hash:

adfb44cb8a94a4e666e7a467d3ff9885d4fb81bbb6f08181f62b1ad3b2545ccc

MD5 hash:

f3d31016fc9af7b2993b12949c2dbaad

SHA1 hash:

6eba4a791a4709ba78d533457f3d504ef1e88523

Link:

https://www.unpac.me/results/a266746d-aacb-4985-8f9c-db8dbe2c04b2/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/adfb44cb8a94a4e666e7a467d3ff9885d4fb81bbb6f08181f62b1ad3b2545ccc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

DLL dll adfb44cb8a94a4e666e7a467d3ff9885d4fb81bbb6f08181f62b1ad3b2545ccc

(this sample)

Cape

https://www.capesandbox.com/analysis/150622/

URLhaus

https://urlhaus.abuse.ch/url/1171623/

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-05 14:55:55 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
1) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
2) [B0012.001] Anti-Static Analysis::Argument Obfuscation
3) [F0002.001] Collection::Application Hook
4) [F0002.002] Collection::Polling
6) [C0026.002] Data Micro-objective::XOR::Encode Data
8) [C0051] File System Micro-objective::Read File
9) [C0052] File System Micro-objective::Writes File
10) [E1510] Impact::Clipboard Modification
11) [C0007] Memory Micro-objective::Allocate Memory
12) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
13) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
14) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
15) [C0040] Process Micro-objective::Allocate Thread Local Storage
16) [C0017] Process Micro-objective::Create Process
17) [C0038] Process Micro-objective::Create Thread
18) [C0041] Process Micro-objective::Set Thread Local Storage Value
19) [C0018] Process Micro-objective::Terminate Process