MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 af1692ced38f5fda305b35be66774822900a0b9617102db4b3da5f7c97f70e3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: af1692ced38f5fda305b35be66774822900a0b9617102db4b3da5f7c97f70e3e
SHA3-384 hash: 87d16cdfb40cb86d6dfd449e332abdc3d55ac56e2678823f4fc01ebd9114c536c55f53f33c608eb0a098536b8336a3ea
SHA1 hash: b9075c67730f2a0d3b65f07663f300cfaff19011
MD5 hash: 3dc3f269b9a89b2d7ea8249d4644a900
humanhash: eighteen-nine-network-bravo
File name:croaks.db
Download: download sample
Signature Quakbot
Create hunting rule
File size:608'256 bytes
First seen:2022-09-30 10:37:57 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 5258e65ea568c264cf3e536d81339bf5 (4 x Quakbot)
ssdeep 6144:sEUrgznbtvSaoyH0+iN4QDClgg9Q6STFOPHuC0AO+jZrR:CgzbVZi2QWig2MHuNyR
Threatray 1'426 similar samples on MalwareBazaar
TLSH T1E3D4AE0AB595C0B3F56D053026E4DA61D6BE7C214B6459EF6BD43B2A0E333C29B32E35
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter pr0xylife
Tags:1664437404 BB dll Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
343
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/315130/
Detection(s):
SecuriteInfo.com.Variant.Tedy.214056.12514.8294.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Modifying an executable file
Creating a window
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/6336c70e90cb824e9d9fadd0/reports/50d66758-5ecf-4c36-8d31-2e3f73427686/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/be32d38f-b566-4f1b-a606-419583ee9fcf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/af1692ced38f5fda305b35be66774822900a0b9617102db4b3da5f7c97f70e3e/
Threat name:
Win32.Infostealer.QBot
Create hunting rule
Status:
Malicious
First seen:
2022-09-30 10:38:26 UTC
File Type:
PE (Dll)
Extracted files:
5
AV detection:
16 of 26 (61.54%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=v4ljftwtr5p5umc3gw7gm52iekiauc4wc4ic3nft3jpxzf7xby7a._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
01fd6e0c8393a5f4112ea19a26bedffb31d6a01f4d3fe5721ca20f479766208f
Quakbot
0b353412e79686c5185dfdf185747e856f379c863ff41d82ce0ef4b69b31b747
Quakbot
42ad1e843f44a725a6666d3d27f10caaa2252a05e1bc0b9c3c315496728f9f25
Quakbot
5e5c55c133d644de044f5bcb782b618fd188a1c6ca707298815ab23295fb43c1
Quakbot
+ 1'416 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:bb campaign:1664437404 banker stealer trojan
Link:
https://tria.ge/reports/220930-mpdmgaebhr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
113.180.55.111:443
58.186.75.42:443
105.184.56.118:995
196.206.133.114:995
80.253.189.55:443
193.3.19.137:443
41.104.80.233:443
49.205.197.13:443
186.81.122.168:443
216.238.83.82:443
216.238.83.82:995
39.44.5.104:995
196.207.146.151:443
216.238.108.61:995
139.84.167.18:995
139.84.167.18:443
216.238.108.61:443
149.28.38.16:995
134.35.12.30:443
131.100.40.13:995
102.189.184.12:995
103.173.121.17:443
102.190.190.242:995
85.86.242.245:443
73.252.27.208:995
41.99.57.148:443
197.120.66.183:995
186.90.144.235:2222
197.49.45.244:995
186.50.137.148:995
181.177.156.209:443
177.45.78.52:993
86.196.181.62:2222
197.203.50.195:443
89.187.169.77:443
Unpacked files
SH256 hash:
df4bb814ef6a0a123b1224c269c0099eaf919df48621ea716e05fb35884b9cde
MD5 hash:
ebb5f4b7e0401cc8876217f83d82fe81
SHA1 hash:
4a7c55b04e8ca2962e54fa45bf91310257d4cba2
Link:
https://www.unpac.me/results/3f1de6aa-1554-4824-803b-60bc3d413a90/
SH256 hash:
afe38a07c081dfc061697ae174663d635321ce3ab20ca64ea97da25daba25143
MD5 hash:
c82a3b8a1e8340f1ef39ba1490974479
SHA1 hash:
903787992032926575cc0d9769124ce467d0cc3a
Detections:
Qakbot
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/3f1de6aa-1554-4824-803b-60bc3d413a90/
Parent samples :
af1692ced38f5fda305b35be66774822900a0b9617102db4b3da5f7c97f70e3e
e07f8ef4cdd69603a4ec2a21524b1236724cad1f3dd527ade09cbdb4b9cb74ef
d127e0c805be94fef708c47ad62037ba3840d7b1db5330deea2bc40160501f45
SH256 hash:
af1692ced38f5fda305b35be66774822900a0b9617102db4b3da5f7c97f70e3e
MD5 hash:
3dc3f269b9a89b2d7ea8249d4644a900
SHA1 hash:
b9075c67730f2a0d3b65f07663f300cfaff19011
Link:
https://www.unpac.me/results/3f1de6aa-1554-4824-803b-60bc3d413a90/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/af1692ced38f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/af1692ced38f5fda305b35be66774822900a0b9617102db4b3da5f7c97f70e3e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:unpacked_qbot
Create hunting rule
Description:Detects unpacked or memory-dumped QBot samples
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.
Rule name:win_qakbot_malped
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/315130/

Comments