MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5db8f1fd3c0c9e620a614cca194af7f1c1066c30e1cd79a948e039b644db0f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 9

Intelligence 9 IOCs YARA 2 File information Comments 1

SHA256 hash:	c5db8f1fd3c0c9e620a614cca194af7f1c1066c30e1cd79a948e039b644db0f6
SHA3-384 hash:	65d19a9c801ea870ee8743a3c2a4ce6312c36698a8f3c03a3e102216154f58bab96f3f4be0cd3c2ecdf65f337e45bb31
SHA1 hash:	276869c5e9d8070dc30204bd12b87125031ffc98
MD5 hash:	58c2d8657b4b23755ab2572f2e85df1e
humanhash:	potato-robin-winner-victor
File name:	44285,5327891204.dat
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	1'470'464 bytes
First seen:	2021-04-13 13:19:57 UTC
Last seen:	2021-04-13 13:52:06 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	413398ffac649594b2b53c025e6614ac (8 x Quakbot)
ssdeep	24576:LAboz/I6budWhdq9EROsB3OPh1tWVJFgQbpXLGCw5:sbeeGRuPPu/U
Threatray	100 similar samples on MalwareBazaar
TLSH	0B657C31B1D2C437D4732A7C9D7AA29D942A7D111E28985B7AE40F4CDF3A6803E2D2D7
Reporter	malwarelabnet
Tags:	Qakbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

235

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/133969/

Detection(s):

SecuriteInfo.com.Trojan.Inject4.10522.21946.22848.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Launching a process

Modifying an executable file

Creating a process with a hidden window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c5db8f1fd3c0c9e620a614cca194af7f1c1066c30e1cd79a948e039b644db0f6/

Threat name:

Win32.Infostealer.QBot

Status:

Malicious

First seen:

2021-04-13 13:20:07 UTC

AV detection:

18 of 47 (38.30%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yxny6h6tyde6mifgctgkdffpp4obazwdbyonpguurybzwzcnwd3a._file

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/210413-gah35418fn/

Unpacked files

SH256 hash:

4026b1ca34068f4400c6635a51e55bdc40fce0c7d89c25a1da6c91ee70a522ed

MD5 hash:

973d633db6b0fc59e3fb411686d3542a

SHA1 hash:

8dea39479c1e2b581789b6f56e5d1ef3ec767888

Detections:

win_qakbot_auto

Link:

https://www.unpac.me/results/858df710-b872-4129-a919-a5b59a4ae2ad/

SH256 hash:

c5db8f1fd3c0c9e620a614cca194af7f1c1066c30e1cd79a948e039b644db0f6

MD5 hash:

58c2d8657b4b23755ab2572f2e85df1e

SHA1 hash:

276869c5e9d8070dc30204bd12b87125031ffc98

Link:

https://www.unpac.me/results/858df710-b872-4129-a919-a5b59a4ae2ad/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c5db8f1fd3c0c9e620a614cca194af7f1c1066c30e1cd79a948e039b644db0f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QakBot Create hunting rule
Author:	kevoreilly
Description:	QakBot Payload

Rule name:	win_qakbot_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/133969/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-04-14 09:21:16 UTC

================================================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
================================================================================
0) [B0001.025] Anti-Behavioral Analysis::Software Breakpoints
1) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
2) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
3) [F0002.002] Collection::Polling
5) [B0030.002] Command and Control::Receive Data
6) [B0030.001] Command and Control::Send Data
7) [C0002.009] Communication Micro-objective::Connect to Server::HTTP Communication
8) [C0002.012] Communication Micro-objective::Create Request::HTTP Communication
9) [C0002.017] Communication Micro-objective::Get Response::HTTP Communication
10) [C0002.005] Communication Micro-objective::Send Data::HTTP Communication
11) [C0002.003] Communication Micro-objective::Send Request::HTTP Communication
12) [C0019] Data Micro-objective::Check String
13) [C0026.001] Data Micro-objective::Base64::Encode Data
14) [C0026.002] Data Micro-objective::XOR::Encode Data
16) [C0047] File System Micro-objective::Delete File
17) [C0051] File System Micro-objective::Read File
18) [C0052] File System Micro-objective::Writes File
19) [C0007] Memory Micro-objective::Allocate Memory
20) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
21) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
22) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
23) [C0040] Process Micro-objective::Allocate Thread Local Storage
24) [C0038] Process Micro-objective::Create Thread
25) [C0041] Process Micro-objective::Set Thread Local Storage Value
26) [C0018] Process Micro-objective::Terminate Process