MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3bf20fa69644c0ca34c600feb3c43f70a1d51408534d1167825a2178a7b7073. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 8


Intelligence 8 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3bf20fa69644c0ca34c600feb3c43f70a1d51408534d1167825a2178a7b7073
SHA3-384 hash: a869c34c9d5c6be3f80c4692bc01e307d937f64551d5217d88397869959384976aded7298cbee466ffa3fddb525fd901
SHA1 hash: 821cc1d1b6fcb7220bc7c00780fc188613fa7d95
MD5 hash: 1df784134421f477e749355185eeaf6d
humanhash: snake-twenty-kentucky-bravo
File name:e3bf20fa69644c0ca34c600feb3c43f70a1d51408534d1167825a2178a7b7073
Download: download sample
Signature Quakbot
Create hunting rule
File size:2'952'168 bytes
First seen:2021-12-14 14:39:36 UTC
Last seen:2021-12-14 17:05:34 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 2ac7a340a3aa040cc3a8e404720833a5 (3 x Quakbot, 1 x ParallaxRAT)
ssdeep 49152:EVUZMcNCu/aXwvg7CfUCOyzw4LxNPpOcQdRckhdIfTRfWG/PB:EVgMsD+woufx1fWG/PB
Threatray 8'570 similar samples on MalwareBazaar
TLSH T17ED56D15FA934CF2DAE712314046F23F56306B2DC263AAB7FF4469BCBA726404D1B259
File icon (PE):PE icon
dhash icon 0220bc96cccc9480 (3 x Quakbot)
Reporter malwarelabnet
Tags:dll obama145 Qakbot Quakbot signed

Code Signing Certificate

Organisation:PHL E STATE ApS
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2021-05-03T00:00:00Z
Valid to:2022-05-03T23:59:59Z
Serial number: b2f9c693a2e6634565f63c79b01dd8f8
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: 2bea432f11e4bae20391c7dfdb815efc4a06e6807cc586798efc81e0a069973f
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
268
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/213956/
Detection(s):
SecuriteInfo.com.ArtemisTrojan.11510.28775.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Сreating synchronization primitives
Launching a process
Modifying an executable file
Searching for synchronization primitives
Creating a process with a hidden window
Sending a custom TCP request
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/61b8acc847bb875c085d562d/reports/bc63c9d8-9784-4f79-aacc-842e1f0b5010/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/86ae1acd-a31f-42b6-86cc-85d9114bc080
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e3bf20fa69644c0ca34c600feb3c43f70a1d51408534d1167825a2178a7b7073/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2021-12-14 14:40:26 UTC
File Type:
PE (Dll)
Extracted files:
9
AV detection:
22 of 28 (78.57%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4o7sb6tjmrgazi2mmah6wpcd64fb2ukaqu2ncftyewrbpct3obzq._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
1f29904e403ca1fb412c1e0901e1c2c386c9be53149c793c1aca1bf5835ace85
Quakbot
24a61ae809abf33396ed1e80315c7fd6a317adff261bff0994acb61d442ccb42
Quakbot
268cf4bdbb872b24825068cc75677e51941b67003a7a589963715808e9f4728a
Quakbot
3d49f30ed4cef3d532cbc73d99560d7c81db4928e8e2e81d2c83ef09196f17c1
Quakbot
a2a676d3c97975edce1e09d9f777287bc953b382962005030f7627d6da08b00a
Quakbot
+ 8'560 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama145 campaign:1639478529 banker evasion stealer trojan
Link:
https://tria.ge/reports/211214-r1wpmsfhc9/
Behaviour
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Loads dropped DLL
Qakbot/Qbot
Windows security bypass
Malware Config
C2 Extraction:
120.150.218.241:995
93.48.80.198:995
102.65.38.67:443
218.101.110.3:995
216.238.72.121:443
216.238.72.121:995
207.246.112.221:995
207.246.112.221:443
216.238.71.31:995
216.238.71.31:443
65.100.174.110:443
186.64.87.213:443
136.143.11.232:443
41.228.22.180:443
140.82.49.12:443
39.49.104.126:995
105.198.236.99:995
78.180.163.25:995
2.222.167.138:443
45.9.20.200:2211
103.142.10.177:443
89.101.97.139:443
194.36.28.26:443
31.215.98.160:443
75.188.35.168:995
173.21.10.71:2222
76.25.142.196:443
71.74.12.34:443
73.151.236.31:443
65.100.174.110:8443
100.1.119.41:443
24.55.112.61:443
24.229.150.54:995
109.12.111.14:443
108.4.67.252:443
67.165.206.193:993
72.252.201.34:995
190.73.3.148:2222
68.204.7.158:443
136.232.34.70:443
94.60.254.81:443
89.137.52.44:443
117.198.149.221:443
73.5.119.219:443
86.148.6.51:443
63.143.92.99:995
68.186.192.69:443
182.176.180.73:443
27.223.92.142:995
187.192.61.177:80
73.140.38.124:443
96.37.113.36:993
117.248.109.38:21
217.165.7.254:995
75.169.58.229:32100
27.5.4.111:2222
197.89.144.207:443
86.98.36.211:443
106.220.76.130:443
129.208.139.229:995
45.46.53.140:2222
190.229.210.128:465
91.178.126.51:995
189.18.181.24:995
185.53.147.51:443
Unpacked files
SH256 hash:
b8c630f2be1f360827bed2070ac5562074c546110fd7eb30a5e7c685f5c34755
MD5 hash:
841c78c0319247aeea21f7004f22b7d7
SHA1 hash:
ddbdc31bfe1eb564859e6c51dea0ca261743145d
Link:
https://www.unpac.me/results/81fe849f-fd72-407a-889f-c6fb033ee733/
SH256 hash:
e3bf20fa69644c0ca34c600feb3c43f70a1d51408534d1167825a2178a7b7073
MD5 hash:
1df784134421f477e749355185eeaf6d
SHA1 hash:
821cc1d1b6fcb7220bc7c00780fc188613fa7d95
Link:
https://www.unpac.me/results/81fe849f-fd72-407a-889f-c6fb033ee733/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e3bf20fa6964/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e3bf20fa69644c0ca34c600feb3c43f70a1d51408534d1167825a2178a7b7073

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_Stomped_PECompilation_Timestamp_InTheFuture
Create hunting rule
Author:ditekSHen
Description:Detect executables with stomped PE compilation timestamp that is greater than local current time
Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/213956/

Comments