MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e004cc75cc35980ea51e7b8761be5aebea359a867cf815ba99057214fde84d01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 9


Intelligence 9 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e004cc75cc35980ea51e7b8761be5aebea359a867cf815ba99057214fde84d01
SHA3-384 hash: 273e918fdf9b815c9ccca2e530799bff70be6582c0023d0501568c084fcccc8d0180f6e96b7b2a3e719ca8a22587ca44
SHA1 hash: cdcde33ffa1c3b1014991b76837a6d5444120e2a
MD5 hash: b259b0e3a1a82c002f059d4aca55349f
humanhash: delta-cold-uranus-oklahoma
File name:e004cc75cc35980ea51e7b8761be5aebea359a867cf815ba99057214fde84d01
Download: download sample
Signature Quakbot
Create hunting rule
File size:345'552 bytes
First seen:2021-02-17 09:36:49 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 86fbdc19e7cee8cd7d94d1a822db2bf6 (21 x Quakbot)
ssdeep 6144:5gOXktvhhOU35RJEesNr3wU7HuAmHKmlEwrPmRPWEpWFn2E6lyDf:LkvhhOKJETRByqTwr03pdf0
Threatray 139 similar samples on MalwareBazaar
TLSH EB747D396A1AD0A2D27C27B183C3EF541E67DAE53234441712B3DE183EB66A4BE35F14
Reporter JAMESWT_WT
Tags:ADV TOURS d.o.o. Quakbot signed

Code Signing Certificate

Organisation:ADV TOURS d.o.o.
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2021-02-11T00:00:00Z
Valid to:2022-02-11T23:59:59Z
Serial number: d3356318924c8c42959bf1d1574e6482
Intelligence: 17 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 962518bfabcda183ed702c09a4ada754bf4da8af8244d7ee57fcf952fd929b8e
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
109
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/117566/
Detection(s):
SecuriteInfo.com.Mal.EncPk-APW.1169.15.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Windows subdirectories
Launching a process
Modifying an executable file
Creating a process with a hidden window
Creating a window
Sending a UDP request
Launching the default Windows debugger (dwwin.exe)
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/610052
Signature
Allocates memory in foreign processes
Found malware configuration
Injects code into the Windows Explorer (explorer.exe)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Schedule REGSVR windows binary
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 354053 Sample: dxjcxlYNoQ Startdate: 17/02/2021 Architecture: WINDOWS Score: 100 43 www.msn.com 2->43 59 Found malware configuration 2->59 61 Sigma detected: Schedule REGSVR windows binary 2->61 63 Multi AV Scanner detection for submitted file 2->63 65 3 other signatures 2->65 10 loaddll32.exe 1 2->10         started        12 regsvr32.exe 2->12         started        14 regsvr32.exe 2->14         started        signatures3 process4 process5 16 regsvr32.exe 10->16         started        19 cmd.exe 1 10->19         started        21 regsvr32.exe 12->21         started        23 regsvr32.exe 14->23         started        signatures6 51 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 16->51 53 Injects code into the Windows Explorer (explorer.exe) 16->53 55 Writes to foreign memory regions 16->55 57 2 other signatures 16->57 25 explorer.exe 8 1 16->25         started        28 iexplore.exe 1 73 19->28         started        30 WerFault.exe 20 9 21->30         started        32 WerFault.exe 23->32         started        process7 file8 41 C:\Users\user\Desktop\dxjcxlYNoQ.dll, PE32 25->41 dropped 34 schtasks.exe 1 25->34         started        36 iexplore.exe 152 28->36         started        process9 dnsIp10 39 conhost.exe 34->39         started        45 edge.gycpi.b.yahoodns.net 87.248.118.22, 443, 49744, 49745 YAHOO-DEBDE United Kingdom 36->45 47 geolocation.onetrust.com 104.20.185.68, 443, 49729, 49730 CLOUDFLARENETUS United States 36->47 49 9 other IPs or domains 36->49 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e004cc75cc35980ea51e7b8761be5aebea359a867cf815ba99057214fde84d01/
Threat name:
Win32.Trojan.GenCBL
Create hunting rule
Status:
Malicious
First seen:
2021-02-17 05:30:46 UTC
File Type:
PE (Dll)
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4acmy5omgwma5ji6podwdps25pvdlgugpt4blouzavzbj7pijuaq._file
Verdict:
malicious
Similar samples:
03ce144d5164335bc0d7b17b3626bfec1f61383846b70054397c7418657c23a5
Quakbot
11d92a8bbd12d0f4634904ccc0037f58e99ab9d71e8341930a25564b3f2dec78
Quakbot
28dc2c996b617a38dea25fdaf5a01af002b3f1832a0c33189cce00b33ea21856
Quakbot
2bd9fd6b0e5a47bc10b4677e73838ed324ca07ae5cd2b67bf9fe1463a8b6113e
Quakbot
2c5e0ddf6689e055e33b0bf8a9d79abe89095107c81f68c44db02d8809986a12
Quakbot
5fdd806e6d8851bf1984e127865bb0a146699fad955d615e392686e59d8b0084
Quakbot
6d10ae2b310fc8d3b8a2690afb40ff153ffca5f320a08d07c7d8b5a05a9dcd2c
Quakbot
748db1f530fa931a4b0bfa8df7c96f84d3bd8b40591960c9453d19df827c0dd4
Quakbot
a395600eca0288b1a6c84746245439360e1e9a6e7277126ec0777d74dbc2222c
Quakbot
e38dfd919696b891fad1c1e5e0d69bcda08a044b526db42f68a149cd5d871bfb
Quakbot
+ 129 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama04 campaign:1613469138 banker stealer trojan
Link:
https://tria.ge/reports/210217-vh7shjgsex/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Qakbot/Qbot
Malware Config
C2 Extraction:
50.29.166.232:995
89.137.211.239:995
172.78.30.215:443
193.248.221.184:2222
80.227.5.69:443
216.201.162.158:443
75.67.192.125:443
105.96.8.96:443
77.211.30.202:995
136.232.34.70:443
87.202.87.210:2222
86.245.46.27:2222
90.101.117.122:2222
81.97.154.100:443
47.196.192.184:443
197.161.154.132:443
78.185.59.190:443
202.188.138.162:443
77.27.204.204:995
203.194.110.74:443
95.77.223.148:443
173.184.119.153:995
38.92.225.121:443
81.150.181.168:2222
176.205.222.30:2078
90.65.236.181:2222
78.63.226.32:443
84.72.35.226:443
85.52.72.32:2222
98.173.34.212:995
71.117.132.169:443
172.87.157.235:3389
2.232.253.79:995
176.181.247.197:443
202.184.20.119:443
189.223.234.23:995
45.118.216.157:443
195.12.154.8:443
196.151.252.84:443
108.160.123.244:443
96.57.188.174:2222
47.22.148.6:443
82.127.125.209:990
97.69.160.4:2222
115.133.243.6:443
173.21.10.71:2222
172.115.177.204:2222
105.198.236.99:443
86.236.77.68:2222
105.198.236.101:443
98.121.187.78:443
140.82.49.12:443
217.133.54.140:32100
197.45.110.165:995
24.50.118.93:443
217.165.231.192:2078
59.90.246.200:443
83.110.12.140:2222
119.153.62.76:3389
45.63.107.192:443
149.28.99.97:995
207.246.116.237:8443
45.77.117.108:995
207.246.116.237:2222
45.77.117.108:8443
149.28.98.196:2222
149.28.98.196:443
45.32.211.207:8443
45.32.211.207:443
144.202.38.185:443
45.32.211.207:995
45.32.211.207:2222
149.28.98.196:995
144.202.38.185:2222
149.28.101.90:2222
45.77.115.208:8443
149.28.101.90:443
45.77.115.208:995
207.246.77.75:443
144.202.38.185:995
207.246.77.75:995
45.77.117.108:2222
149.28.101.90:995
207.246.116.237:995
45.77.115.208:443
45.63.107.192:995
207.246.77.75:8443
45.77.117.108:443
207.246.77.75:2222
149.28.101.90:8443
45.77.115.208:2222
207.246.116.237:443
45.63.107.192:2222
27.223.92.142:995
73.25.124.140:2222
193.252.48.200:443
85.132.36.111:2222
45.46.53.140:2222
85.58.200.50:2222
188.25.63.105:443
75.136.26.147:443
94.53.92.42:443
157.131.108.180:443
71.199.192.62:443
144.139.47.206:443
67.6.12.4:443
144.139.166.18:443
47.187.99.96:443
71.197.126.250:443
75.118.1.141:443
65.27.228.247:443
71.74.12.34:443
73.153.211.227:443
187.250.6.217:443
98.240.24.57:443
76.25.142.196:443
199.19.117.131:443
189.149.77.114:443
98.252.118.134:443
47.217.24.69:6881
96.250.60.138:443
201.143.235.13:443
189.211.177.183:995
186.28.55.211:443
50.25.89.74:443
151.205.102.42:443
70.54.25.76:2222
82.12.157.95:995
74.68.144.202:443
189.146.183.105:443
181.48.190.78:443
109.12.111.14:443
82.76.47.211:443
72.252.201.69:443
106.51.85.162:443
89.3.198.238:443
72.240.200.181:2222
195.43.173.70:443
24.229.150.54:995
78.22.58.205:3389
213.60.147.140:443
174.104.31.209:443
2.7.69.217:2222
83.110.103.152:443
78.97.207.104:443
182.48.193.200:443
197.51.82.72:443
74.222.204.82:995
41.39.134.183:443
149.28.99.97:2222
Unpacked files
SH256 hash:
bbfd63584a96d6e8e700eab340c4d2d685c504feee9e1966d8e050905c34c686
MD5 hash:
1705ed295dc007e6aada354df0eab708
SHA1 hash:
e6b64c2b5931432492908eff74514e184197f50b
Link:
https://www.unpac.me/results/ba5c62a4-d2ea-4d03-9e5f-f711d1e943ed/
SH256 hash:
e004cc75cc35980ea51e7b8761be5aebea359a867cf815ba99057214fde84d01
MD5 hash:
b259b0e3a1a82c002f059d4aca55349f
SHA1 hash:
cdcde33ffa1c3b1014991b76837a6d5444120e2a
Link:
https://www.unpac.me/results/ba5c62a4-d2ea-4d03-9e5f-f711d1e943ed/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e004cc75cc35980ea51e7b8761be5aebea359a867cf815ba99057214fde84d01

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:qbot_bin
Create hunting rule
Author:James_inthe_box
Description:Qbot Qakbot
Reference:https://app.any.run/tasks/b89d7454-403c-4c81-95db-7ecbba38eb02
Rule name:Select_from_enumeration
Create hunting rule
Author:James_inthe_box
Description:IP and port combo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/117566/

Comments