MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbe2f650ed2c319130bc060a600c4b9d17d255d319b24fac10da293c673b3572. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	cbe2f650ed2c319130bc060a600c4b9d17d255d319b24fac10da293c673b3572
SHA3-384 hash:	a6450b74caeff145ec76fb2c585a9fa25e5ad10a2d6622165edf94b78e3efff4ddf9d7b0e5554fba397c1eeda21cb31b
SHA1 hash:	c722600b1355bbcfa06bd727be9ddc93c2664d8b
MD5 hash:	67bdb286d03b8b4760e792b29c5fd6a1
humanhash:	video-edward-asparagus-shade
File name:	67bdb286d03b8b4760e792b29c5fd6a1.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	820'736 bytes
First seen:	2021-02-26 14:41:33 UTC
Last seen:	2021-02-26 16:54:36 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	c7bf76465596a3688d4dbbe64c4d0225 (1 x Quakbot)
ssdeep	12288:jZVeDFo0FKTukoTVhAb27ggmcNGCXrQjaECkE2ecrKSTkWtsc5:j2G0mukucb7gmcNGCXrQjU2eQt
Threatray	202 similar samples on MalwareBazaar
TLSH	3105BF22E2D0CC37C1F3263D9C3B5798AC7DBE512D2499462FE42E4C5F39A913A16297
Reporter	abuse_ch
Tags:	dll Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

352

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/119429/

Detection(s):

PUA.Win.Adware.Slugin-6803969-0

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching the default Windows debugger (dwwin.exe)

Sending a UDP request

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cbe2f650ed2c319130bc060a600c4b9d17d255d319b24fac10da293c673b3572/

Threat name:

Win32.Trojan.Bsymem

Status:

Malicious

First seen:

2021-02-26 14:18:29 UTC

AV detection:

18 of 29 (62.07%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zprpmuhnfqyzcmf4ayfgadcltul5evotdgze7laq3iutyzz3gvza._file

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:biden02 campaign:1614254614 banker stealer trojan

Link:

https://tria.ge/reports/210226-dwheaennbn/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Program crash

Qakbot/Qbot

Suspicious use of NtCreateProcessExOtherParentProcess

Malware Config

C2 Extraction:

71.163.223.159:443
83.110.9.71:2222
87.202.87.210:2222
47.22.148.6:443
78.180.179.136:443
67.8.103.21:443
140.82.49.12:443
213.60.147.140:443
187.250.39.162:443
86.236.77.68:2222
108.46.145.30:443
172.87.157.235:3389
79.115.174.55:443
217.133.54.140:32100
83.110.109.106:2222
78.63.226.32:443
83.196.56.65:2222
59.90.246.200:443
89.137.211.239:995
105.96.8.96:443
125.209.114.182:995
106.51.85.162:443
73.153.211.227:443
105.198.236.99:443
45.63.107.192:2222
149.28.101.90:995
149.28.99.97:995
45.63.107.192:995
207.246.77.75:443
207.246.77.75:2222
149.28.99.97:443
149.28.99.97:2222
45.32.211.207:443
45.32.211.207:995
45.32.211.207:8443
45.32.211.207:2222
45.63.107.192:443
149.28.98.196:2222
149.28.98.196:995
149.28.98.196:443
144.202.38.185:443
144.202.38.185:2222
144.202.38.185:995
149.28.101.90:443
149.28.101.90:8443
149.28.101.90:2222
45.77.115.208:8443
45.77.115.208:443
45.77.115.208:995
45.77.115.208:2222
207.246.77.75:995
207.246.77.75:8443
207.246.116.237:443
207.246.116.237:995
207.246.116.237:8443
207.246.116.237:2222
45.77.117.108:443
45.77.117.108:8443
45.77.117.108:995
45.77.117.108:2222
80.227.5.69:443
219.76.148.200:443
197.51.82.72:443
193.248.221.184:2222
84.72.35.226:443
2.232.253.79:995
24.43.22.218:993
81.97.154.100:443
90.65.236.181:2222
95.77.223.148:443
83.110.103.152:443
119.153.43.235:3389
89.3.198.238:443
98.192.185.86:443
115.133.243.6:443
2.7.116.188:2222
188.26.91.212:443
113.22.175.141:443
176.181.247.197:443
173.21.10.71:2222
45.46.53.140:2222
50.29.166.232:995
96.37.113.36:993
202.188.138.162:443
76.25.142.196:443
65.27.228.247:443
122.148.156.131:995
71.74.12.34:443
142.117.191.18:2222
202.184.20.119:443
98.252.118.134:443
189.211.177.183:995
189.222.59.177:443
74.68.144.202:443
189.146.183.105:443
71.197.126.250:443
32.210.98.6:443
187.250.118.233:995
92.59.35.196:2222
195.12.154.8:443
67.6.12.4:443
86.160.137.132:443
96.57.188.174:2222
38.92.225.121:443
197.45.110.165:995
181.48.190.78:443
173.184.119.153:995
24.229.150.54:995
50.244.112.106:443
144.139.166.18:443
81.150.181.168:2222
68.186.192.69:443
74.222.204.82:995
71.117.132.169:443
98.121.187.78:443
75.136.26.147:443
85.52.72.32:2222
109.12.111.14:443
80.11.173.82:8443
209.210.187.52:443
209.210.187.52:995
108.160.123.244:443
24.152.219.253:995
196.151.252.84:443
172.115.177.204:2222
24.139.72.117:443
24.55.112.61:443
105.198.236.101:443
186.28.55.211:443
97.69.160.4:2222
47.187.108.172:443
216.201.162.158:443
71.199.192.62:443
71.88.193.17:443
71.187.170.235:443
77.211.30.202:995
77.27.204.204:995
189.210.115.207:443
125.239.152.76:995
82.12.157.95:995
98.173.34.213:995
151.205.102.42:443
72.240.200.181:2222
160.3.187.114:443
73.25.124.140:2222
24.50.118.93:443
82.127.125.209:990
79.129.121.81:995
189.223.234.23:995
108.31.15.10:995

Unpacked files

SH256 hash:

db99902dd3d4f5c681f4b983aaf04204d50bb82a891e68d364a7806edfaa60cf

MD5 hash:

09c8e9305c681394fc1603be976f3642

SHA1 hash:

9381fbb5fb05a82ee1fc32a59b053fc200e2eb76

Link:

https://www.unpac.me/results/b76e1fbc-b374-4096-b9ce-e5a1b5a4b5b2/

SH256 hash:

cbe2f650ed2c319130bc060a600c4b9d17d255d319b24fac10da293c673b3572

MD5 hash:

67bdb286d03b8b4760e792b29c5fd6a1

SHA1 hash:

c722600b1355bbcfa06bd727be9ddc93c2664d8b

Link:

https://www.unpac.me/results/b76e1fbc-b374-4096-b9ce-e5a1b5a4b5b2/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QakBot Create hunting rule
Author:	kevoreilly
Description:	QakBot Payload

Rule name:	qbot_bin Create hunting rule
Author:	James_inthe_box
Description:	Qbot Qakbot
Reference:	https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02