MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d212b3da7479c82b1c822c115fe9080983d729e6318e6e32aa6424bf0a5bde8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 11

Intelligence 11 IOCs YARA File information Comments

SHA256 hash:	d212b3da7479c82b1c822c115fe9080983d729e6318e6e32aa6424bf0a5bde8a
SHA3-384 hash:	43c11a35b184580bc6a70b1270486eedbf0c407f8bee6ced94c4bd35e28a8f82760a02086435bbb3aef4bfaa234a0819
SHA1 hash:	f8e63a50e43b4dd2e5244ceb371ee536b7e15fd1
MD5 hash:	73c09743d6b0f7da8d2d6dda77607539
humanhash:	five-berlin-leopard-friend
File name:	d212b3da7479c82b1c822c115fe9080983d729e6318e6e32aa6424bf0a5bde8a
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	988'506 bytes
First seen:	2022-03-11 14:04:03 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	4be20c1d0cff08001af7f6da02464dc6 (9 x Quakbot)
ssdeep	24576:S9t3O1k4YwdH9CZ4nJ/TwiuPiwQU2SAHl4XoWSIgX4TH:S9n4RJlLYKKgX4T
Threatray	175 similar samples on MalwareBazaar
TLSH	T1AD259D63E3D0487EC16A2B399D2B576898B96A113D24F4C63AE41C8C5F3764376273E3
File icon (PE):
dhash icon	399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter	pr0xylife
Tags:	AA dll Qakbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

167

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/249441/

Detection(s):

Win.Malware.Qakbot-9940971-1

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Launching a process

Searching for the window

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

control.exe keylogger overlay packed qakbot

Link:

https://www.filescan.io/uploads/622b56da0cd58dbd927e9294/reports/257046f3-0470-4d81-a336-60dd20816bc6/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Qakbot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5e992a10-7b1b-4d31-9691-653ca468869f

Result

Threat name:

CryptOne Qbot

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/954904

Signature

Allocates memory in foreign processes

Antivirus detection for URL or domain

Contains functionality to detect sleep reduction / modifications

Found malware configuration

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Sigma detected: Suspicious Call by Ordinal

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Writes to foreign memory regions

Yara detected CryptOne packer

Yara detected Qbot

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d212b3da7479c82b1c822c115fe9080983d729e6318e6e32aa6424bf0a5bde8a/

Threat name:

Win32.Trojan.BotX

Status:

Malicious

First seen:

2022-03-11 14:05:14 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

24 of 41 (58.54%)

Threat level:

5/5

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:aa campaign:1646840852 banker stealer trojan

Link:

https://tria.ge/reports/220311-rc975ahfh5/

Behaviour

Suspicious use of WriteProcessMemory

Program crash

Qakbot/Qbot

Malware Config

C2 Extraction:

82.152.39.39:443
91.177.173.10:995
140.82.49.12:443
176.67.56.94:443
47.180.172.159:443
75.99.168.194:443
140.82.63.183:443
140.82.63.183:995
181.118.183.94:443
2.50.27.78:443
41.230.62.211:993
24.43.99.75:443
217.165.79.31:443
24.178.196.158:2222
189.253.32.61:995
197.37.66.133:995
173.174.216.62:443
47.23.89.61:995
47.23.89.61:993
173.21.10.71:2222
191.112.19.94:443
196.203.37.215:80
69.159.200.138:2222
39.44.188.102:995
136.143.11.232:443
41.84.244.32:995
89.101.97.139:443
71.13.93.154:2222
176.57.126.138:443
75.99.168.194:61201
100.1.108.246:443
83.110.75.83:995
217.165.79.31:995
208.107.221.224:443
173.170.224.168:995
63.143.92.99:995
70.57.207.83:443
72.12.115.90:22
72.252.201.34:995
70.51.139.58:2222
114.79.148.170:443
103.139.242.30:990
80.11.74.81:2222
83.110.153.238:61200
139.64.13.51:995
70.46.220.114:443
72.252.201.34:990
144.202.2.175:995
190.189.33.6:32101
182.191.92.203:995
93.48.80.198:995
31.35.28.29:443
39.49.53.23:995
40.134.247.125:995
75.159.9.236:443
176.45.218.254:995
38.70.253.226:2222
92.99.229.158:2222
78.100.194.196:6883
96.246.158.154:995
89.211.187.132:2222
197.164.168.41:993
86.97.209.134:1194
76.70.9.169:2222
183.82.103.213:443
208.101.87.135:443
120.150.218.241:995
67.209.195.198:443
217.128.122.65:2222
197.237.74.185:995
79.167.199.210:995
45.9.20.200:443
96.21.251.127:2222
92.177.45.46:2078
206.217.0.154:995
186.10.247.110:443
172.114.160.81:995
209.210.95.228:32100
1.161.97.158:443
74.15.2.252:2222
78.169.100.120:443
105.186.100.243:995
41.228.22.180:443
63.153.150.20:443
70.163.1.219:443
86.195.158.178:2222
103.87.95.131:2222
72.76.94.99:443
190.73.3.148:2222
108.4.67.252:443
84.241.8.23:32103
24.55.67.176:443
80.14.188.219:2222
207.170.238.231:443
217.128.93.27:2222
149.28.238.199:443
45.63.1.12:995
144.202.3.39:995
144.202.3.39:443
45.76.167.26:995
45.63.1.12:443
45.76.167.26:443
144.202.2.175:443
149.28.238.199:995
117.248.109.38:21
197.89.21.109:443
89.86.33.217:443
120.61.3.163:443
86.98.11.110:443
217.165.85.106:993
5.95.58.211:2087
41.130.133.118:995
81.229.130.188:443
124.41.193.166:443
119.158.105.8:995
102.140.70.62:443
176.253.27.51:443
1.161.97.158:995
103.139.242.30:993
175.145.235.37:443
183.88.63.73:2222
128.106.122.181:443
39.52.62.239:995
76.25.142.196:443
32.221.225.247:443
121.74.187.191:995
86.98.48.115:995
71.74.12.34:443
189.146.51.56:443
191.99.191.28:443
73.151.236.31:443
216.10.217.114:443
76.169.147.192:32103
47.180.172.159:50010
187.170.7.81:443
47.156.191.217:443
201.170.181.247:443
5.32.41.45:443
172.114.160.81:443
68.204.7.158:443
105.187.31.228:995
187.59.18.65:443
31.215.70.101:443
109.12.111.14:443
41.84.246.125:443
83.110.218.135:32101
118.189.242.45:2083
39.52.217.44:995
89.137.52.44:443
217.164.120.130:2222

Unpacked files

SH256 hash:

775d5100b3bb9b25e28fb528a01347ca76fb3eb3ab34a3d491573eed32980fa2

MD5 hash:

4c50bdfe0d26e0bb2f1e561cdcf19748

SHA1 hash:

a0bcf9c0f8941fe32ba7a98de46e702f03fd4c9b

Link:

https://www.unpac.me/results/93b74e81-0bc8-4528-9999-5b6fbb83df12/

SH256 hash:

5ba45432b9d6a4875c61ba9d44bde9bd10b974d5388bc0abe9ae9dfccfce7e56

MD5 hash:

98a0c7716dd4e393f3825761df54564b

SHA1 hash:

20a03b6c2b140151e04e2cdfce21bef04f228f75

Link:

https://www.unpac.me/results/93b74e81-0bc8-4528-9999-5b6fbb83df12/

SH256 hash:

d212b3da7479c82b1c822c115fe9080983d729e6318e6e32aa6424bf0a5bde8a

MD5 hash:

73c09743d6b0f7da8d2d6dda77607539

SHA1 hash:

f8e63a50e43b4dd2e5244ceb371ee536b7e15fd1

Link:

https://www.unpac.me/results/93b74e81-0bc8-4528-9999-5b6fbb83df12/

Malware family:

CryptOne

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/d212b3da7479/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d212b3da7479c82b1c822c115fe9080983d729e6318e6e32aa6424bf0a5bde8a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/249441/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample