MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 de3e8d2119f640a76193181eecf18b8eb003ba64e4b146a78dbb5abc6ea231da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	de3e8d2119f640a76193181eecf18b8eb003ba64e4b146a78dbb5abc6ea231da
SHA3-384 hash:	d45e5e74d6564ea76bffe2a60e26d56809115b81d1c3b16f81410e2e4d8811f15b80c6b13a97d571ce197e1fcbee78ae
SHA1 hash:	bf702cf231960b99fa3096c47f063e563f2346b6
MD5 hash:	dbade29bd2c0624ca069186b08454685
humanhash:	fillet-vermont-tango-winter
File name:	de3e8d2119f640a76193181eecf18b8eb003ba64e4b146a78dbb5abc6ea231da
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	805'336 bytes
First seen:	2021-03-11 07:49:41 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	f4d58943cc6fa5e2a1175df8bbe33009 (6 x Quakbot)
ssdeep	12288:J3UUEi88NZ8FYgcGJxeHyScioRgBfMdK6Uwh1/6aMCxtd2b:NjEKkFsGJUDpAEfUK4Lxab
Threatray	230 similar samples on MalwareBazaar
TLSH	EB05B032F6904433D173267D4D57729C9839BE4D3E38AC4A6BE45E4CAF3A680351639B
Reporter	JAMESWT_WT
Tags:	GEN Sistemi d.o.o. Quakbot signed

Code Signing Certificate

Organisation:	GEN Sistemi, d.o.o.
Issuer:	Sectigo RSA Code Signing CA
Algorithm:	sha256WithRSAEncryption
Valid from:	2021-02-26T00:00:00Z
Valid to:	2022-02-26T23:59:59Z
Serial number:	cc95d6ebf18a3711e196aea210465a19
Intelligence:	10 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:	This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:	SHA256
Thumbprint:	85305aace7f9acc7ef41e546f9ce8d01d8f6b81da1db537e92e74ee49ad6816f
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

124

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/123732/

Detection(s):

PUA.Win.Adware.Slugin-6840354-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the Windows subdirectories

Launching a process

Modifying an executable file

Creating a process with a hidden window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/de3e8d2119f640a76193181eecf18b8eb003ba64e4b146a78dbb5abc6ea231da/

Threat name:

Win32.Trojan.PinkSbot

Status:

Malicious

First seen:

2021-03-11 07:47:08 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

25 of 47 (53.19%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=3y7i2iiz6zakoymtdapoz4mlr2yahote4syunj4nxnnly3vcghna._file

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:obama10 campaign:1615286191 banker stealer trojan

Link:

https://tria.ge/reports/210311-cxcj6tv372/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Program crash

Loads dropped DLL

Qakbot/Qbot

Malware Config

C2 Extraction:

76.94.200.148:995
140.82.49.12:443
24.95.61.62:443
195.43.173.70:443
197.45.110.165:995
87.202.87.210:2222
79.115.174.55:443
196.151.252.84:443
45.118.216.157:443
77.211.30.202:995
89.3.198.238:443
47.196.192.184:443
86.175.79.249:443
80.227.5.69:443
70.168.130.172:995
83.110.108.38:2222
71.117.132.169:443
184.189.122.72:443
47.22.148.6:443
84.72.35.226:443
59.90.246.200:443
95.77.223.148:443
45.77.117.108:995
45.77.117.108:8443
144.202.38.185:995
149.28.101.90:443
207.246.77.75:8443
45.77.115.208:995
45.63.107.192:443
45.77.117.108:2222
149.28.98.196:995
149.28.98.196:443
149.28.99.97:995
207.246.77.75:995
207.246.77.75:2222
149.28.101.90:2222
207.246.116.237:2222
207.246.116.237:8443
207.246.116.237:995
45.77.117.108:443
144.202.38.185:2222
207.246.116.237:443
45.77.115.208:8443
45.77.115.208:2222
149.28.98.196:2222
149.28.99.97:2222
45.32.211.207:8443
149.28.101.90:8443
149.28.101.90:995
149.28.99.97:443
45.63.107.192:2222
45.77.115.208:443
45.32.211.207:2222
45.32.211.207:995
207.246.77.75:443
144.202.38.185:443
45.32.211.207:443
75.136.40.155:443
24.117.107.120:443
24.50.118.93:443
105.198.236.101:443
105.198.236.99:443
97.69.160.4:2222
68.186.192.69:443
71.41.184.10:3389
217.133.54.140:32100
197.161.154.132:443
144.139.47.206:443
71.199.192.62:443
2.7.116.188:2222
172.78.30.215:443
75.67.192.125:443
74.222.204.82:995
90.65.236.181:2222
89.137.211.239:995
193.248.221.184:2222
115.133.243.6:443
202.188.138.162:443
81.97.154.100:443
71.163.223.159:443
176.181.247.197:443
190.85.91.154:443
41.39.134.183:443
122.148.156.131:995
67.6.12.4:443
73.25.124.140:2222
83.110.9.71:2222
173.21.10.71:2222
92.59.35.196:2222
98.192.185.86:443
136.232.34.70:443
80.11.173.82:8443
203.198.96.215:443
144.139.166.18:443
216.201.162.158:443
173.25.45.66:443
96.21.251.127:2222
75.136.26.147:443
108.29.32.251:443
106.51.52.111:443
125.239.152.76:995
189.146.183.105:443
75.118.1.141:443
67.165.206.193:993
202.185.166.181:443
189.210.115.207:443
96.37.113.36:993
77.27.204.204:995
72.240.200.181:2222
151.205.102.42:443
86.220.62.251:2222
24.55.112.61:443
83.196.56.65:2222
109.12.111.14:443
186.31.77.42:443
71.197.126.250:443
24.229.150.54:995
72.252.201.69:443
108.46.145.30:443
74.68.144.202:443
24.43.22.218:993
199.19.117.131:443
84.247.55.190:8443
188.26.91.212:443
181.48.190.78:443
98.252.118.134:443
196.221.207.137:995
213.60.147.140:443
83.110.103.152:443
189.222.59.177:443
45.46.53.140:2222
106.51.85.162:443
182.190.19.241:3389
78.63.226.32:443
209.210.187.52:443
86.236.77.68:2222
98.240.24.57:443
78.97.207.104:443
24.139.72.117:443
82.12.157.95:995
125.209.114.182:443
174.104.22.30:443
182.48.193.200:443
125.63.101.62:443
2.50.16.111:2078
81.214.126.173:2222
71.74.12.34:443
76.25.142.196:443
73.28.92.55:443
142.117.191.18:2222

Unpacked files

SH256 hash:

97ebce1e2ba9a00197ccc069173d68d8acee443bab042a301c38d08d721a8ed9

MD5 hash:

d077a55b48a6bec013df4455f42e08b1

SHA1 hash:

0bcde3fb9a9c3e7b8155376e8347ee1b9a6fa82d

Link:

https://www.unpac.me/results/85aa29be-2568-4409-9b71-8dde5f70fab1/

SH256 hash:

de3e8d2119f640a76193181eecf18b8eb003ba64e4b146a78dbb5abc6ea231da

MD5 hash:

dbade29bd2c0624ca069186b08454685

SHA1 hash:

bf702cf231960b99fa3096c47f063e563f2346b6

Link:

https://www.unpac.me/results/85aa29be-2568-4409-9b71-8dde5f70fab1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/de3e8d2119f640a76193181eecf18b8eb003ba64e4b146a78dbb5abc6ea231da

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QakBot Create hunting rule
Author:	kevoreilly
Description:	QakBot Payload

Rule name:	qbot_bin Create hunting rule
Author:	James_inthe_box
Description:	Qbot Qakbot
Reference:	https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02