MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3a2c056c730666fedabfed5e3cc2dee12d9c3ca36ac2d7c5289cfe29c125050. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3a2c056c730666fedabfed5e3cc2dee12d9c3ca36ac2d7c5289cfe29c125050
SHA3-384 hash: 42ea9da79453532e270ee2c225142d318ca1f54a1762ffda54aaf73abe3d6dc8877b918cc2f1701feb124d447a5ff8a2
SHA1 hash: 8ff540ba601429c2ee0a444b0d2ec2650d178d23
MD5 hash: 2e7f90e0c595d88d28f9fd979ccfcf33
humanhash: cold-maine-arkansas-leopard
File name:diatomaceous.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:393'216 bytes
First seen:2022-10-03 09:46:53 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 5258e65ea568c264cf3e536d81339bf5 (4 x Quakbot)
ssdeep 6144:8WlZhgoMdtBYTNSlWBsAOrbd62IYQ8jjHH62uzdMPF699o9:Vl3goMdrb5J6wQ8faVn99o
TLSH T1AA846A0379D9BCB6C579123027379BE0C72DEC250BA0C9EF67D8196A4A3C2837525BE5
TrID 32.2% (.EXE) Win64 Executable (generic) (10523/12/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4505/5/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 6edbb12b17172b96 (10 x Quakbot, 9 x Heodo, 7 x BazaLoader)
Reporter pr0xylife
Tags:dll Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
254
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/316060/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Modifying an executable file
Creating a window
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware
Link:
https://www.filescan.io/uploads/633aaf99dace43a378f41e73/reports/020c8e78-619e-4783-9398-3fede19b34bb/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6b1dae82-9180-4478-8514-1622b169c81e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e3a2c056c730666fedabfed5e3cc2dee12d9c3ca36ac2d7c5289cfe29c125050/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-09-30 23:44:24 UTC
File Type:
PE (Dll)
Extracted files:
17
AV detection:
19 of 26 (73.08%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ormavwhgbtg73nl73k6htbn5yjntq6kg2wc27csrhh6fhaskbia._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/221003-lr7gwsfhh3/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
75.116.87.44:14933
64.55.103.194:9151
80.214.68.88:40730
97.184.129.40:2118
216.44.143.70:26851
239.39.127.10:38876
57.33.10.57:17737
201.128.252.151:58865
211.76.239.250:34506
124.58.65.86:13247
41.8.154.58:7614
6.55.240.195:27003
139.242.121.12:23370
8.81.30.103:64297
168.13.24.67:37382
17.219.125.20:59669
136.66.66.194:40287
63.172.177.141:57252
195.44.25.26:29277
67.212.106.154:59890
149.254.111.67:39052
184.74.22.12:50436
166.33.149.229:19515
172.102.164.60:43562
155.28.49.2:51545
7.122.114.191:33775
220.68.130.196:7948
121.236.113.177:14197
47.2.191.47:32393
49.93.218.109:41033
174.124.34.188:14831
178.143.168.245:48707
159.196.166.193:58136
1.104.105.37:49572
225.108.223.250:46683
105.208.24.120:59473
180.179.25.125:42514
236.83.216.21:0
90.29.227.242:1085
212.204.93.86:48405
115.34.223.65:24926
250.151.244.173:3488
16.95.145.59:42025
50.6.212.181:17804
23.86.160.130:53103
212.133.85.240:62503
122.125.236.31:0
Unpacked files
SH256 hash:
f6cdda5a4d11560f32c1f079ff32fb204fb79107816691c5f3b3c6a3607eeca2
MD5 hash:
3971d0e70e630517020f45056d8080af
SHA1 hash:
64bf8af9c701bab355585693864db3f3332c4414
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/04838962-4252-44aa-a01d-577073158b5e/
Parent samples :
5b54f57dbaa74fa589afb2d26d6c6b39e0c2930bd88fea3172556ce96b3eb959
e3a2c056c730666fedabfed5e3cc2dee12d9c3ca36ac2d7c5289cfe29c125050
SH256 hash:
e3a2c056c730666fedabfed5e3cc2dee12d9c3ca36ac2d7c5289cfe29c125050
MD5 hash:
2e7f90e0c595d88d28f9fd979ccfcf33
SHA1 hash:
8ff540ba601429c2ee0a444b0d2ec2650d178d23
Link:
https://www.unpac.me/results/04838962-4252-44aa-a01d-577073158b5e/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e3a2c056c730/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e3a2c056c730666fedabfed5e3cc2dee12d9c3ca36ac2d7c5289cfe29c125050

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB
Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:unpacked_qbot
Create hunting rule
Description:Detects unpacked or memory-dumped QBot samples
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.
Rule name:win_qakbot_malped
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/316060/

Comments