MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcbd804aff1a584011f23f6f95d3dc5e59c4f2341236ec6967fa3c29699d09e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	bcbd804aff1a584011f23f6f95d3dc5e59c4f2341236ec6967fa3c29699d09e6
SHA3-384 hash:	8abbebc30d5ef08c8708f9f37715c830bc3fe78a0e91bd1138d31c4db35d18400efe58703185b11db9165bc83ccd36c6
SHA1 hash:	ce0d29580f965c223f635557c4dc0ac5915631b7
MD5 hash:	14b499afc4680f4951a066d370b2704c
humanhash:	early-lemon-wyoming-moon
File name:	mal.bin
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	2'321'408 bytes
First seen:	2020-12-22 16:22:27 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	11b84014462dfc4cffface746a4f3f4c (2 x Quakbot)
ssdeep	6144:EC+9DR9L2Y6fGKUjts0/UCLk3+gA5sE5uHd:dkvIfnMs596S9
Threatray	12 similar samples on MalwareBazaar
TLSH	1EB5C292882B9F37A83C5415A4D3EC6A3A343699FA012C36778D63913813C796797F4F
Reporter	j_dubp
Tags:	qbot Quakbot

j_dubp

XLS attachment *-88.xls

Intelligence

File Origin

# of uploads :

# of downloads :

472

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/108957/

Detection(s):

Win.Malware.Farp-9811742-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a file in the Windows subdirectories

Launching a process

Modifying an executable file

Creating a process with a hidden window

Creating a window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bcbd804aff1a584011f23f6f95d3dc5e59c4f2341236ec6967fa3c29699d09e6/

Threat name:

Win32.Trojan.QBot

Status:

Malicious

First seen:

2020-12-22 16:23:06 UTC

AV detection:

19 of 29 (65.52%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xs6yasx7djmeaepsh5xzlu64lzm4j4ruci3oy2lh7i6cs2m5bhta._file

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:tr02 campaign:1608026105 banker stealer trojan

Link:

https://tria.ge/reports/201222-7e5g1kqrbn/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Suspicious use of AdjustPrivilegeToken

Program crash

Loads dropped DLL

Qakbot/Qbot

Malware Config

C2 Extraction:

111.95.212.237:2222
190.220.8.10:995
109.154.79.222:2222
83.110.250.71:995
149.28.99.97:2222
45.63.107.192:443
149.28.101.90:2222
149.28.101.90:995
149.28.99.97:443
149.28.98.196:443
144.202.38.185:2222
45.77.115.208:995
149.28.98.196:2222
149.28.98.196:995
149.28.99.97:995
45.63.107.192:2222
144.202.38.185:995
144.202.38.185:443
45.63.107.192:995
5.13.84.186:995
68.83.89.188:443
67.141.11.98:443
219.76.148.249:443
86.245.82.249:2078
116.240.78.45:995
37.182.244.124:2222
72.186.1.237:443
78.97.207.104:443
80.14.22.234:2222
202.141.225.158:443
72.28.255.159:995
37.6.208.105:2222
161.142.217.62:443
188.253.85.49:995
217.165.3.30:443
90.61.38.208:2222
2.49.219.254:22
124.29.232.108:443
2.50.143.154:2222
2.50.2.216:443
197.161.154.132:443
103.76.160.110:443
51.223.138.251:443
102.185.13.89:443
85.101.187.146:443
92.154.83.96:2087
45.118.216.157:443
86.122.248.164:2222
92.154.83.96:1194
217.165.125.217:443
92.154.83.96:2078
85.105.29.218:443
151.60.38.21:443
156.213.217.254:443
2.50.57.224:443
217.162.149.212:443
182.161.6.57:3389
24.27.82.216:2222
37.166.181.234:0
45.77.115.208:2222
203.106.116.190:443
85.52.72.32:2222
2.51.240.250:995
2.91.9.248:443
101.109.175.33:443
41.228.47.147:443
78.101.199.138:995
125.63.101.62:443
90.53.103.26:2222
86.124.93.144:443
79.114.177.162:993
5.2.212.254:443
86.127.22.190:443
81.133.234.36:2222
5.15.109.245:443
37.130.115.124:443
2.50.88.125:995
62.38.114.12:2222
78.181.19.134:443
187.155.59.73:443
102.187.95.88:443
79.129.216.215:2222
141.237.135.194:443
42.117.61.10:443
93.148.241.179:2222
41.205.16.222:443
46.53.2.70:443
151.61.125.180:2222
151.73.121.136:443
176.181.247.197:443
149.28.101.90:8443
2.7.69.217:2222
84.117.176.32:443
109.205.204.229:2222
184.179.14.130:22
203.106.195.67:443
121.58.199.24:443
216.201.162.158:443
83.110.13.182:2222
172.87.157.235:3389
45.118.65.34:443
79.129.252.62:2222
2.50.30.147:995
2.50.159.104:2222
105.198.236.101:443
78.96.199.79:443
217.133.54.140:32100
172.91.19.192:443
196.204.207.111:443
77.132.113.187:2222
185.163.221.77:2222
197.49.240.8:995
45.77.115.208:8443
108.30.125.94:443
213.60.147.140:443
217.165.9.48:443
94.70.36.227:2222
59.99.36.20:443
104.37.20.207:995
5.193.106.230:2078
117.215.198.5:443
2.50.49.18:22
2.88.1.76:995
66.25.168.167:2222
173.21.10.71:2222
106.250.150.98:443
58.152.9.133:443
72.36.59.46:2222
89.137.211.239:995
96.241.66.126:443
93.86.1.159:995
95.76.27.6:443
217.128.117.218:2222
37.211.23.45:995
120.150.34.178:443
86.120.138.232:443
41.97.125.168:443
87.27.110.90:2222
82.76.47.211:443
94.69.242.254:2222
90.101.62.189:2222
78.187.125.116:2222
197.57.96.163:443
197.90.131.100:32100
5.193.178.36:2078
196.151.252.84:443
118.100.159.27:443
105.198.236.99:443
185.105.131.233:443
45.77.115.208:443

Unpacked files

SH256 hash:

87c1bf405c5527736d1f4884e8bf205eaf1a3dba918bb4cd42bffa7277379d40

MD5 hash:

95ea6715841b594b89eb152d78c9cf46

SHA1 hash:

eedbee8d4bb6ca19c25b0e7d130b7eb987e405d7

Link:

https://www.unpac.me/results/60b22974-8b02-4b19-a054-78da549c990b/

SH256 hash:

bcbd804aff1a584011f23f6f95d3dc5e59c4f2341236ec6967fa3c29699d09e6

MD5 hash:

14b499afc4680f4951a066d370b2704c

SHA1 hash:

ce0d29580f965c223f635557c4dc0ac5915631b7

Link:

https://www.unpac.me/results/60b22974-8b02-4b19-a054-78da549c990b/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

qbot

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bcbd804aff1a584011f23f6f95d3dc5e59c4f2341236ec6967fa3c29699d09e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.