MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c424121f6200844b235cd622ec0f2a16631a56c7c4508da7f42e83b9f1263cec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c424121f6200844b235cd622ec0f2a16631a56c7c4508da7f42e83b9f1263cec
SHA3-384 hash: 097fa334d0b707c3adf2a68183f5703f5d9adf3b3bb4af2aa20341557b8c5dc84c175f1468556c5f50d92f15743e03a2
SHA1 hash: e694bdeb6a561f920d51ea434e953be96455589f
MD5 hash: 322d3dca9a1973b7a01548e920e98666
humanhash: equal-glucose-green-uniform
File name:c424121f6200844b235cd622ec0f2a16631a56c7c4508da7f42e83b9f1263cec
Download: download sample
Signature Quakbot
Create hunting rule
File size:345'552 bytes
First seen:2021-02-17 09:36:43 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 86fbdc19e7cee8cd7d94d1a822db2bf6 (21 x Quakbot)
ssdeep 6144:tgOXktvhhOU35RJEesNr3wU7HuAmHKmlEwrPmRPWEpWFn2E6lyDv:/kvhhOKJETRByqTwr03pdf8
Threatray 144 similar samples on MalwareBazaar
TLSH A7747D396A1AD0A2D27C27B183C3EF541E67DAE53234441712B3DE183EB66A4BE35F14
Reporter JAMESWT_WT
Tags:ADV TOURS d.o.o. Quakbot signed

Code Signing Certificate

Organisation:ADV TOURS d.o.o.
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2021-02-11T00:00:00Z
Valid to:2022-02-11T23:59:59Z
Serial number: d3356318924c8c42959bf1d1574e6482
Intelligence: 17 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 962518bfabcda183ed702c09a4ada754bf4da8af8244d7ee57fcf952fd929b8e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117565/
Detection(s):
SecuriteInfo.com.Mal.EncPk-APW.1169.15.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Launching a process
Modifying an executable file
Creating a process with a hidden window
Sending a UDP request
Creating a window
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/610053
Signature
Allocates memory in foreign processes
Found malware configuration
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Schedule REGSVR windows binary
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 354055 Sample: BpV9PHuNll Startdate: 17/02/2021 Architecture: WINDOWS Score: 96 49 Found malware configuration 2->49 51 Sigma detected: Schedule REGSVR windows binary 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 2 other signatures 2->55 9 loaddll32.exe 1 2->9         started        11 regsvr32.exe 2->11         started        13 regsvr32.exe 2->13         started        process3 process4 15 regsvr32.exe 9->15         started        18 cmd.exe 1 9->18         started        20 regsvr32.exe 11->20         started        22 regsvr32.exe 13->22         started        signatures5 57 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 15->57 59 Injects code into the Windows Explorer (explorer.exe) 15->59 61 Writes to foreign memory regions 15->61 63 2 other signatures 15->63 24 explorer.exe 8 1 15->24         started        27 iexplore.exe 1 73 18->27         started        30 WerFault.exe 20 9 20->30         started        process6 dnsIp7 39 C:\Users\user\Desktop\BpV9PHuNll.dll, PE32 24->39 dropped 32 schtasks.exe 1 24->32         started        47 192.168.2.1 unknown unknown 27->47 34 iexplore.exe 157 27->34         started        file8 process9 dnsIp10 37 conhost.exe 32->37         started        41 img.img-taboola.com 34->41 43 tls13.taboola.map.fastly.net 151.101.1.44, 443, 49743, 49744 FASTLYUS United States 34->43 45 8 other IPs or domains 34->45 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c424121f6200844b235cd622ec0f2a16631a56c7c4508da7f42e83b9f1263cec/
Threat name:
Win32.Trojan.GenCBL
Create hunting rule
Status:
Malicious
First seen:
2021-02-16 19:13:21 UTC
File Type:
PE (Dll)
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yqsbeh3caccewi242yroydzkczrruvwhyrii3j7uf2b3t4jghtwa._file
Verdict:
malicious
Similar samples:
1301c04439622d546f5b4f0834155e17db23ccdd57381fd6fca8edf1962660b4
Quakbot
28dc2c996b617a38dea25fdaf5a01af002b3f1832a0c33189cce00b33ea21856
Quakbot
2c5e0ddf6689e055e33b0bf8a9d79abe89095107c81f68c44db02d8809986a12
Quakbot
5fdd806e6d8851bf1984e127865bb0a146699fad955d615e392686e59d8b0084
Quakbot
6d10ae2b310fc8d3b8a2690afb40ff153ffca5f320a08d07c7d8b5a05a9dcd2c
Quakbot
748db1f530fa931a4b0bfa8df7c96f84d3bd8b40591960c9453d19df827c0dd4
Quakbot
89f295e3f67f0d1787dff3c18d74764fb354c09ad6ade10544577dfedc25e83d
Quakbot
8f7a1de9a03d301ac9144fd6620978ccded44aeb05a62425b32cd1c464705da1
Quakbot
a395600eca0288b1a6c84746245439360e1e9a6e7277126ec0777d74dbc2222c
Quakbot
e004cc75cc35980ea51e7b8761be5aebea359a867cf815ba99057214fde84d01
Quakbot
+ 134 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama04 campaign:1613469138 banker stealer trojan
Link:
https://tria.ge/reports/210217-3r8txa5wyx/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Malware Config
C2 Extraction:
50.29.166.232:995
89.137.211.239:995
172.78.30.215:443
193.248.221.184:2222
80.227.5.69:443
216.201.162.158:443
75.67.192.125:443
105.96.8.96:443
77.211.30.202:995
136.232.34.70:443
87.202.87.210:2222
86.245.46.27:2222
90.101.117.122:2222
81.97.154.100:443
47.196.192.184:443
197.161.154.132:443
78.185.59.190:443
202.188.138.162:443
77.27.204.204:995
203.194.110.74:443
95.77.223.148:443
173.184.119.153:995
38.92.225.121:443
81.150.181.168:2222
176.205.222.30:2078
90.65.236.181:2222
78.63.226.32:443
84.72.35.226:443
85.52.72.32:2222
98.173.34.212:995
71.117.132.169:443
172.87.157.235:3389
2.232.253.79:995
176.181.247.197:443
202.184.20.119:443
189.223.234.23:995
45.118.216.157:443
195.12.154.8:443
196.151.252.84:443
108.160.123.244:443
96.57.188.174:2222
47.22.148.6:443
82.127.125.209:990
97.69.160.4:2222
115.133.243.6:443
173.21.10.71:2222
172.115.177.204:2222
105.198.236.99:443
86.236.77.68:2222
105.198.236.101:443
98.121.187.78:443
140.82.49.12:443
217.133.54.140:32100
197.45.110.165:995
24.50.118.93:443
217.165.231.192:2078
59.90.246.200:443
83.110.12.140:2222
119.153.62.76:3389
45.63.107.192:443
149.28.99.97:995
207.246.116.237:8443
45.77.117.108:995
207.246.116.237:2222
45.77.117.108:8443
149.28.98.196:2222
149.28.98.196:443
45.32.211.207:8443
45.32.211.207:443
144.202.38.185:443
45.32.211.207:995
45.32.211.207:2222
149.28.98.196:995
144.202.38.185:2222
149.28.101.90:2222
45.77.115.208:8443
149.28.101.90:443
45.77.115.208:995
207.246.77.75:443
144.202.38.185:995
207.246.77.75:995
45.77.117.108:2222
149.28.101.90:995
207.246.116.237:995
45.77.115.208:443
45.63.107.192:995
207.246.77.75:8443
45.77.117.108:443
207.246.77.75:2222
149.28.101.90:8443
45.77.115.208:2222
207.246.116.237:443
45.63.107.192:2222
27.223.92.142:995
73.25.124.140:2222
193.252.48.200:443
85.132.36.111:2222
45.46.53.140:2222
85.58.200.50:2222
188.25.63.105:443
75.136.26.147:443
94.53.92.42:443
157.131.108.180:443
71.199.192.62:443
144.139.47.206:443
67.6.12.4:443
144.139.166.18:443
47.187.99.96:443
71.197.126.250:443
75.118.1.141:443
65.27.228.247:443
71.74.12.34:443
73.153.211.227:443
187.250.6.217:443
98.240.24.57:443
76.25.142.196:443
199.19.117.131:443
189.149.77.114:443
98.252.118.134:443
47.217.24.69:6881
96.250.60.138:443
201.143.235.13:443
189.211.177.183:995
186.28.55.211:443
50.25.89.74:443
151.205.102.42:443
70.54.25.76:2222
82.12.157.95:995
74.68.144.202:443
189.146.183.105:443
181.48.190.78:443
109.12.111.14:443
82.76.47.211:443
72.252.201.69:443
106.51.85.162:443
89.3.198.238:443
72.240.200.181:2222
195.43.173.70:443
24.229.150.54:995
78.22.58.205:3389
213.60.147.140:443
174.104.31.209:443
2.7.69.217:2222
83.110.103.152:443
78.97.207.104:443
182.48.193.200:443
197.51.82.72:443
74.222.204.82:995
41.39.134.183:443
149.28.99.97:2222
Unpacked files
SH256 hash:
bbfd63584a96d6e8e700eab340c4d2d685c504feee9e1966d8e050905c34c686
MD5 hash:
1705ed295dc007e6aada354df0eab708
SHA1 hash:
e6b64c2b5931432492908eff74514e184197f50b
Link:
https://www.unpac.me/results/54421a13-cbec-452e-b462-fca8f577d83a/
SH256 hash:
c424121f6200844b235cd622ec0f2a16631a56c7c4508da7f42e83b9f1263cec
MD5 hash:
322d3dca9a1973b7a01548e920e98666
SHA1 hash:
e694bdeb6a561f920d51ea434e953be96455589f
Link:
https://www.unpac.me/results/54421a13-cbec-452e-b462-fca8f577d83a/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c424121f6200844b235cd622ec0f2a16631a56c7c4508da7f42e83b9f1263cec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:qbot_bin
Create hunting rule
Author:James_inthe_box
Description:Qbot Qakbot
Reference:https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/117565/

Comments