MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce2ce903d184097c4f499384a81de2ede73ef9cd75ce6e4195eec0adfe2c0a27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce2ce903d184097c4f499384a81de2ede73ef9cd75ce6e4195eec0adfe2c0a27
SHA3-384 hash: 06caeca473a521969fecfef896f5f832e6162ef406f143786926d8cd3e77ae59ea698564f199773de7478e88f28bd1d7
SHA1 hash: 904f7880d8688561be02c93d9ce310a1212463da
MD5 hash: 6a4b623b6535b7603eb6bc9e299c8356
humanhash: cola-papa-lima-utah
File name:a0qrtc.tmp
Download: download sample
Signature Quakbot
Create hunting rule
File size:565'248 bytes
First seen:2021-01-22 21:59:56 UTC
Last seen:2021-01-23 00:16:54 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 883c271d5e4c854f960ace025ba8acae (17 x Quakbot)
ssdeep 12288:qc3Pe+5EAH/eV4P6FzUQB4ZWvo3KPoHxabXrpbQMH:qc3Pe+JH/eV4o1Bdvo3XABn
Threatray 33 similar samples on MalwareBazaar
TLSH F2C4AE52F6E89039F75D13344C67D97603B9BC00866DED9B32DE2E4F24663B2B526388
Reporter malware_traffic
Tags:dll krk01 Qakbot Quakbot Shathak TA551


Avatar
malware_traffic
Run method: regsvr32.exe [filename]

Intelligence

File Origin
# of uploads :
2
# of downloads :
142
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/113563/
Detection(s):
SecuriteInfo.com.Generic.mg.6a4b623b6535b760.26775.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Launching a process
Creating a process with a hidden window
Creating a window
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce2ce903d184097c4f499384a81de2ede73ef9cd75ce6e4195eec0adfe2c0a27/
Threat name:
Win32.Trojan.BankerX
Create hunting rule
Status:
Malicious
First seen:
2021-01-22 22:00:09 UTC
AV detection:
5 of 46 (10.87%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zywosa6rqqexyt2jsockqhpc5xtt56onoxhg4qmv53ak37rmbitq._file
Verdict:
malicious
Similar samples:
11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78
Quakbot
14bf2a818871aa56931bd59e0ac58ddf5b80948e8009974c1e23e1065823e855
Quakbot
4e380065d1bf7c83b5d986c190cf8886046cf91e7408573d67fe01203efec1a2
Quakbot
5fef1f3e9b7584a0f6be325230fabecde15b8c2c32df2234bfb9044313aef6b4
Quakbot
6f7d90eaf620223280720a36a4e2e43ffa1d7b5870f5c04962a3e204252c2d93
Quakbot
8b843d780403b64d562c38c56dcd9cc8abe2c70cc5324660cbd2757e41fd5057
Quakbot
ac35f31d6b9b3ef74fb60cbeb591865927be1c98fc5a2b3732b72395e7349984
Quakbot
bcbd804aff1a584011f23f6f95d3dc5e59c4f2341236ec6967fa3c29699d09e6
Quakbot
d606356ddfafc5101226b384ed8e400c02b7896e2b1cbd2614ef440b30b14fd4
Quakbot
da3d2bdd47a64d79a3e572c18d61037df07764c852af2bdaff7b763f866615f4
Quakbot
+ 23 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:krk01 campaign:1611226305 banker stealer trojan
Link:
https://tria.ge/reports/210122-a2qr73y91n/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Suspicious use of AdjustPrivilegeToken
Program crash
Loads dropped DLL
Qakbot/Qbot
Malware Config
C2 Extraction:
193.248.221.184:2222
69.123.179.70:443
197.45.110.165:995
85.132.36.111:2222
88.233.91.244:443
149.28.98.196:2222
207.246.116.237:995
45.32.211.207:995
149.28.101.90:995
207.246.116.237:2222
144.202.38.185:443
149.28.101.90:8443
45.32.211.207:8443
149.28.101.90:2222
207.246.77.75:443
207.246.116.237:443
45.63.107.192:2222
207.246.77.75:8443
207.246.77.75:2222
149.28.99.97:995
149.28.98.196:995
207.246.116.237:8443
149.28.98.196:443
45.77.115.208:443
149.28.99.97:2222
45.63.107.192:443
45.63.107.192:995
45.77.115.208:2222
144.202.38.185:2222
207.246.77.75:995
45.32.211.207:2222
144.202.38.185:995
45.32.211.207:443
149.28.99.97:443
149.28.101.90:443
106.51.52.111:443
83.110.12.140:2222
89.3.198.238:443
86.220.60.133:2222
45.77.115.208:8443
45.77.115.208:995
71.117.132.169:443
82.76.47.211:443
125.63.101.62:443
86.98.93.124:2078
178.152.70.12:995
78.97.207.104:443
77.27.174.49:995
173.70.165.101:995
64.121.114.87:443
188.24.128.253:443
89.137.211.239:995
80.227.5.70:443
81.97.154.100:443
98.121.187.78:443
42.3.8.54:443
31.5.21.66:995
80.7.129.64:995
84.72.35.226:443
188.25.63.105:443
140.82.49.12:443
216.201.162.158:443
2.50.2.216:443
75.136.40.155:443
79.129.252.62:2222
2.7.69.217:2222
51.9.198.164:2222
96.19.117.140:443
75.67.192.125:443
24.27.82.216:2222
105.198.236.99:443
95.77.223.148:443
97.69.160.4:2222
78.63.226.32:443
172.78.30.215:443
202.184.210.27:443
86.236.77.68:2222
197.161.154.132:443
105.198.236.101:443
41.205.16.179:443
203.106.195.67:443
172.87.157.235:3389
173.21.10.71:2222
27.223.92.142:995
86.124.93.144:443
217.133.54.140:32100
95.76.27.6:443
106.250.150.98:443
94.53.92.42:443
69.47.239.10:443
47.208.8.187:443
71.14.110.199:443
75.136.26.147:443
71.74.12.34:443
96.37.113.36:993
76.111.128.194:443
202.188.138.162:443
74.68.144.202:443
180.222.161.85:443
70.168.130.172:995
201.143.95.254:443
201.127.5.175:443
76.25.142.196:443
67.165.206.193:993
50.244.112.106:443
90.175.88.99:2222
186.155.151.167:443
24.201.61.153:2078
80.106.85.24:2222
72.204.242.138:443
151.60.82.200:443
96.227.127.13:995
83.110.248.121:995
184.189.122.72:443
47.146.169.85:443
47.22.148.6:443
76.94.200.148:995
71.197.126.250:443
92.59.35.196:2222
190.85.91.154:443
189.237.7.9:443
71.187.170.235:443
79.129.121.81:995
12.5.37.4:995
81.88.254.62:443
189.210.115.207:443
67.6.91.75:443
83.110.108.181:2222
24.152.219.253:995
108.160.123.244:443
50.29.166.232:995
105.226.208.140:443
45.46.53.140:2222
142.129.227.86:443
68.225.60.77:995
184.179.14.130:22
196.151.252.84:443
78.96.168.18:443
72.240.200.181:2222
209.210.187.52:443
74.75.237.11:443
46.153.36.53:995
84.232.252.202:2222
24.43.22.218:993
71.182.142.63:443
31.215.69.207:443
68.186.192.69:443
98.116.21.115:443
72.252.201.69:443
151.205.102.42:443
Unpacked files
SH256 hash:
0692701be9077c586f362fc05f033c640ace443c0781cd28e62b9fe2a28cb4a4
MD5 hash:
e635e28f8b2e37b00c1bb7e534672e43
SHA1 hash:
a512c555734485b1d4f4b0cb712c44e50504dadc
Link:
https://www.unpac.me/results/55d009a8-751b-4058-a47d-e84ccefea803/
SH256 hash:
ce2ce903d184097c4f499384a81de2ede73ef9cd75ce6e4195eec0adfe2c0a27
MD5 hash:
6a4b623b6535b7603eb6bc9e299c8356
SHA1 hash:
904f7880d8688561be02c93d9ce310a1212463da
Link:
https://www.unpac.me/results/55d009a8-751b-4058-a47d-e84ccefea803/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ce2ce903d184097c4f499384a81de2ede73ef9cd75ce6e4195eec0adfe2c0a27

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:qbot_bin
Create hunting rule
Author:James_inthe_box
Description:Qbot Qakbot
Reference:https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/113563/

Comments