MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e10c39b660a84f703700fb8d6bd19dc4f9bbab239b2e62f6d2817864154b0a85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e10c39b660a84f703700fb8d6bd19dc4f9bbab239b2e62f6d2817864154b0a85
SHA3-384 hash: 07e00c21c069e8ff514440b5f64d63ed62770d6bd6ebe533e404ef92408373e138948a6267f844d6a8ade75f91ff7e07
SHA1 hash: 9d30eb983cf6af5e69c76f6c5ccfb97d06ac9a26
MD5 hash: 9b94df46dae77e2e38e2e11c26ed2e25
humanhash: muppet-ohio-venus-north
File name:e10c39b660a84f703700fb8d6bd19dc4f9bbab239b2e62f6d2817864154b0a85
Download: download sample
Signature Quakbot
Create hunting rule
File size:952'323 bytes
First seen:2021-12-15 17:07:02 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 7533ddeefffa2275531c73d5b41e6d39 (1 x Quakbot)
ssdeep 6144:CyH2acgeciDa1sgTR3bwWu1lePpBQjFw:NHugeBARrwW8acF
Threatray 447 similar samples on MalwareBazaar
TLSH T1DB15F967C3C5A443FDC751BB3928B2E67B20B0541E64D0221F3969509F99FE2AB50EE3
Reporter malwarelabnet
Tags:cullinan exe Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
346
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
e10c39b660a84f703700fb8d6bd19dc4f9bbab239b2e62f6d2817864154b0a85
Verdict:
No threats detected
Analysis date:
2021-12-15 17:09:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/85a51212-4f6f-465b-aa84-29822f50fd3f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/214379/
Detection(s):
SecuriteInfo.com.Variant.Jaik.49863.639.6978.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Launching a process
DNS request
Modifying an executable file
Сreating synchronization primitives
Searching for synchronization primitives
Creating a process with a hidden window
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Malware family:
n/a
Score:
  5/10
Tags:
n/a
Link:
https://dragonfly.certego.net/analysis/2134/overview
Behaviour
MalwareBazaar
CheckCmdLine
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
greyware keylogger overlay
Link:
https://www.filescan.io/uploads/61ba20b945ca64e57f12007b/reports/7f166cac-3eec-40a5-b3a1-6a15dc4e8ca6/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0ba68cbb-2803-4292-adb8-84db43b295fc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e10c39b660a84f703700fb8d6bd19dc4f9bbab239b2e62f6d2817864154b0a85/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2021-12-15 17:08:09 UTC
File Type:
PE (Dll)
AV detection:
24 of 27 (88.89%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
186b5f0acbf214a1f442530198f213e675de3cd908b33501b646a5f8494d1ecc
Quakbot
18d5151ff156139ee901d21abd933dbe3efb3630e30e1acf2b0cbf0a34f3d3ca
Quakbot
1f29904e403ca1fb412c1e0901e1c2c386c9be53149c793c1aca1bf5835ace85
Quakbot
268cf4bdbb872b24825068cc75677e51941b67003a7a589963715808e9f4728a
Quakbot
78abc92488d49165ca64ad2a169febbdba6ca105cb6fe18b02c660b6fb867588
Quakbot
a2a676d3c97975edce1e09d9f777287bc953b382962005030f7627d6da08b00a
Quakbot
e3bf20fa69644c0ca34c600feb3c43f70a1d51408534d1167825a2178a7b7073
Quakbot
+ 437 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:cullinan campaign:1639333530 banker evasion stealer trojan
Link:
https://tria.ge/reports/211215-vm1m8ababm/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
65.100.174.110:443
173.21.10.71:2222
140.82.49.12:443
190.73.3.148:2222
76.25.142.196:443
71.74.12.34:443
31.215.98.160:443
93.48.80.198:995
45.9.20.200:2211
41.228.22.180:443
109.12.111.14:443
63.143.92.99:995
120.150.218.241:995
94.60.254.81:443
86.148.6.51:443
218.101.110.3:995
216.238.71.31:443
207.246.112.221:443
216.238.72.121:443
216.238.71.31:995
207.246.112.221:995
216.238.72.121:995
186.64.87.195:443
73.151.236.31:443
78.191.12.29:995
67.165.206.193:993
68.186.192.69:443
65.100.174.110:8443
89.137.52.44:443
75.188.35.168:995
105.198.236.99:995
182.176.180.73:443
103.142.10.177:443
136.232.34.70:443
68.204.7.158:443
27.223.92.142:995
102.65.38.67:443
189.175.200.244:80
100.1.119.41:443
73.140.38.124:443
73.171.4.177:443
89.101.97.139:443
24.229.150.54:995
72.252.201.34:995
39.49.44.85:995
2.222.167.138:443
96.37.113.36:993
117.248.109.38:21
39.43.130.50:995
75.169.58.229:32100
24.55.112.61:443
27.5.4.111:2222
197.89.144.207:443
73.5.119.219:443
136.143.11.232:443
86.98.36.211:443
106.220.76.130:443
129.208.139.229:995
45.46.53.140:2222
190.229.210.128:465
91.178.126.51:995
189.18.181.24:995
185.53.147.51:443
Unpacked files
SH256 hash:
7565bb8e7e0c2002c81b442544659141971357fa6f7cf80126b973226e162446
MD5 hash:
60405cf5237171fa3d80e47fd6f7c819
SHA1 hash:
3e0d151b7f1c0bc697ab4a731d3e04a524ff5703
Link:
https://www.unpac.me/results/74e91e8f-7148-457b-854f-cda68a171264/
SH256 hash:
9385fd476103a349a4aef240b658d13017799a58935ee9ee24349606f874b823
MD5 hash:
342f08c9973ba9dddd67bd8b35806e75
SHA1 hash:
b5752bd55346e972c5e6c463fed59391b0fe31fc
Link:
https://www.unpac.me/results/74e91e8f-7148-457b-854f-cda68a171264/
SH256 hash:
e10c39b660a84f703700fb8d6bd19dc4f9bbab239b2e62f6d2817864154b0a85
MD5 hash:
9b94df46dae77e2e38e2e11c26ed2e25
SHA1 hash:
9d30eb983cf6af5e69c76f6c5ccfb97d06ac9a26
Link:
https://www.unpac.me/results/74e91e8f-7148-457b-854f-cda68a171264/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e10c39b660a8/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.24
Link:
https://yomi.yoroi.company/submissions/e10c39b660a84f703700fb8d6bd19dc4f9bbab239b2e62f6d2817864154b0a85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_KB_CERT_1f3216f428f850be2c66caa056f6d821
Create hunting rule
Author:ditekSHen
Description:Detects executables signed with stolen, revoked or invalid certificates

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/214379/

Comments