MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba30680b04158de98aef7f09b10c17236f368d76b212531581dcaa3b3e40d381. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 6

Intelligence 6 IOCs YARA File information Comments

SHA256 hash:	ba30680b04158de98aef7f09b10c17236f368d76b212531581dcaa3b3e40d381
SHA3-384 hash:	d346a3682710f3d9d3cbe17ab1e871d781e5bdbc015d06a044ee9762037da0ae8007ff881a5f7af5c27c6c66d473dfe4
SHA1 hash:	07ca729d9556b144b4c2924d6d820e8a4813c4cc
MD5 hash:	19dfe41a3c89903e987548f1a95d1789
humanhash:	nineteen-nevada-fillet-timing
File name:	590906.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	2'130'128 bytes
First seen:	2020-12-07 19:11:20 UTC
Last seen:	2020-12-07 20:38:10 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	82dcd2585191883c51de54c12fc261ee (5 x Quakbot)
ssdeep	3072:3OU5X9BrbGJ/V37wg4MuYXV8zPYkY8A4JlW:3PzlqPL94MVtn4JI
Threatray	1'384 similar samples on MalwareBazaar
TLSH	6BA5B12E3C6BB77A6E5281746816A67CC7197F88F97B00A817C7674845E7CE23E1E0C4
Reporter	ffforward
Tags:	dll Qakbot qbot Quakbot Shahin Mobin signed

Code Signing Certificate

Organisation:	Shahin Mobin
Issuer:	Ascertia Public CA 1
Algorithm:	sha256WithRSAEncryption
Valid from:	Dec 1 14:07:03 2020 GMT
Valid to:	Jan 1 14:07:03 2021 GMT
Serial number:	055794C1B0E141B375C0CE0D263FE888B3A9FFCD
Thumbprint Algorithm:	SHA256
Thumbprint:	ED9CF88965D4F7F5530E42198B5656E8D9FFE558DCE55338E8B74122D38EA380
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

273

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/107084/

Detection(s):

SecuriteInfo.com.Mal.EncPk-APV.17132.20639.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the Windows subdirectories

Launching a process

Modifying an executable file

Creating a process with a hidden window

Creating a window

Sending a UDP request

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ba30680b04158de98aef7f09b10c17236f368d76b212531581dcaa3b3e40d381/

Threat name:

Win32.Trojan.GenCBL

Status:

Malicious

First seen:

2020-12-07 19:12:06 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

11 of 29 (37.93%)

Threat level:

5/5

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:abc108m campaign:1607356318 banker stealer trojan

Link:

https://tria.ge/reports/201207-1d58h45rb6/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Program crash

Loads dropped DLL

Qakbot/Qbot

Malware Config

C2 Extraction:

92.59.35.196:2083
2.89.122.180:995
78.181.19.134:443
5.193.175.76:2078
24.139.72.117:443
62.38.114.12:2222
2.51.240.250:995
174.62.13.151:443
189.210.115.207:443
71.197.126.250:443
187.7.236.197:995
187.149.126.53:443
96.247.180.108:443
174.55.197.4:443
187.190.250.175:443
24.206.4.203:2222
72.36.11.22:443
197.135.240.243:443
216.137.142.200:2222
160.3.184.253:443
186.189.208.238:443
84.232.252.202:2222
106.51.85.162:443
120.151.95.167:443
74.124.191.6:443
108.46.145.30:443
75.136.40.155:443
184.21.136.237:995
68.186.192.69:443
185.105.131.233:443
185.138.134.114:443
24.43.22.220:993
187.192.151.3:443
94.69.242.254:2222
141.193.83.107:443
187.213.105.132:995
93.113.177.152:443
151.27.88.197:443
97.69.160.4:2222
77.30.79.74:443
172.87.134.226:443
94.52.160.116:443
161.199.180.159:443
87.27.110.90:2222
86.162.13.35:2222
67.82.244.199:2222
185.163.221.77:2222
94.59.236.155:995
84.117.176.32:443
71.182.142.63:443
196.151.252.84:443
67.177.196.177:0
197.51.82.115:995
72.240.200.181:2222
105.198.236.101:443
81.214.126.173:2222
67.237.68.126:2222
185.125.151.138:443
197.45.110.165:995
149.28.101.90:443
73.32.115.251:443
196.204.207.111:443
109.115.125.81:50000
185.246.9.69:995
78.96.199.79:443
172.87.157.235:3389
72.36.59.46:2222
47.146.34.236:443
24.27.82.216:2222
24.95.61.62:443
73.55.254.225:443
24.179.13.119:443
32.212.117.188:443
87.218.53.206:2222
63.155.29.193:995
71.163.223.144:443
184.97.145.239:443
176.45.218.26:995
24.201.61.153:2078
151.33.226.156:443
78.101.158.1:61201
173.18.126.193:2222
90.101.62.189:2222
65.131.41.96:995
178.87.18.221:443
99.244.210.10:443
83.202.68.220:2222
80.195.103.146:2222
180.233.150.134:443
96.225.88.23:443
96.41.93.96:443
110.142.205.182:443
41.228.242.14:443
37.106.7.7:443
47.44.217.98:443
174.87.65.179:443
202.185.199.172:443
85.204.189.105:443
90.53.103.229:2222
86.122.248.164:2222
86.99.134.235:2222
164.155.230.98:443
208.99.100.129:443
216.201.162.158:443
193.83.25.177:995
80.106.85.24:2222
24.178.196.158:443
109.154.193.21:2222
172.78.30.215:443
67.141.11.98:443
80.14.22.234:2222
73.51.245.231:995
37.116.152.122:2078
96.40.175.33:443
2.90.124.155:995
70.45.219.126:443
193.248.154.174:2222
162.157.19.33:2222
189.252.62.238:995
109.205.204.229:2222
37.210.255.225:8443
78.132.96.100:6881
5.15.54.40:443
208.93.202.41:443
120.150.218.241:995
41.39.134.183:443
120.150.218.241:443
116.240.78.45:995
184.179.14.130:22
109.209.94.165:2222
109.93.245.93:995
199.116.241.147:443
83.114.243.80:2222
82.12.157.95:995
2.50.56.81:443
47.21.192.182:2222
78.97.207.104:443
98.240.24.57:443
77.211.30.202:995
184.98.97.227:995
79.113.119.125:443
93.146.133.102:2222
174.76.21.134:443
190.85.91.154:443
85.132.36.111:2222
96.21.251.127:2222
58.179.21.147:995
98.124.76.187:443
86.121.3.80:443
78.97.110.47:443