MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6e67623e24b8c95021d63966ac7f2ba20e7fbe9495b32290871fc9fa8fe4fe3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 9

Intelligence 9 IOCs YARA File information Comments

SHA256 hash:	e6e67623e24b8c95021d63966ac7f2ba20e7fbe9495b32290871fc9fa8fe4fe3
SHA3-384 hash:	8d7d8acea72057d093c218a4f575d13a0c953cf94a7203639c598d01db4ce75ebd618227b95022359ba65e929ea56c92
SHA1 hash:	c2dcf36fcd305e11877fbb6a80c60b16bf3aa4bd
MD5 hash:	9784964314a873f959b016ed50dff5c5
humanhash:	uncle-avocado-tennis-timing
File name:	555555555.png
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	1'205'264 bytes
First seen:	2020-09-18 17:08:40 UTC
Last seen:	2020-09-18 17:50:22 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	3bd7c16a16ad7d5b3966a30a82496732 (7 x Quakbot)
ssdeep	6144:GUg69tR5KCcCg8nqVbkQSaPOnNxRQVwSav4dyxDYoQYJUpg1MwE4s0m+Z1Af6k+:Z99trKTX84bkQfUO/aQdeMo3e+k4jACJ
Threatray	428 similar samples on MalwareBazaar
TLSH	AD45D06AB777C491F3E91FF605E207AC5A7BA895BB214007259A3F1D7CF23903C2644A
Reporter	dripbrrr
Tags:	abc005 executable Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

207

Origin country :

n/a

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Variant.Razy.751573.27317.10986.UNOFFICIAL

SecuriteInfo.com.Variant.Razy.751573.1699.19323.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Sending a UDP request

Creating a process with a hidden window

Creating a file in the Windows subdirectories

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Launching a process

Creating a window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Threat name:

Qbot

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/470330

Signature

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to detect virtual machines (IN, VMware)

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Injects code into the Windows Explorer (explorer.exe)

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Qbot

Behaviour

Behavior Graph:

Download SVG

Detection:

qakbot

Link:

https://mwdb.cert.pl/sample/e6e67623e24b8c95021d63966ac7f2ba20e7fbe9495b32290871fc9fa8fe4fe3/

Threat name:

Win32.Trojan.QBot

Status:

Malicious

First seen:

2020-09-18 17:10:07 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=43thmi7cjogjkaq5molgvr7sxiqop67jjfntekiioh6j7kh6j7rq._file

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

trojan banker stealer family:qakbot

Link:

https://tria.ge/reports/200918-3g1jvbg642/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Executes dropped EXE

Qakbot/Qbot

Malware Config

C2 Extraction:

50.244.112.10:995
207.237.1.152:443
184.97.148.2:443
207.255.161.8:993
69.167.206.238:50001
72.36.59.46:2222
173.26.189.151:443
2.50.59.177:443
217.162.149.212:443
199.247.22.145:443
203.106.195.67:443
109.154.214.224:2222
117.199.14.31:443
175.211.225.118:443
188.51.33.232:995
50.244.112.106:443
65.30.213.13:6882
24.37.178.158:443
47.28.131.209:443
207.255.161.8:995
141.158.47.123:443
72.204.242.138:990
188.25.244.220:443
46.248.56.248:995
2.7.65.32:2222
202.141.244.118:995
98.16.204.189:995
189.231.196.236:443
2.91.73.105:995
81.133.234.36:2222
98.121.187.78:443
84.117.176.32:443
24.205.42.241:443
50.104.68.223:443
213.31.203.48:2222
188.210.225.179:443
209.137.209.163:995
36.77.151.211:443
95.77.223.148:443
207.246.75.201:443
45.77.193.83:443
45.32.154.10:443
59.26.204.144:443
67.170.137.8:443
80.195.103.146:2222
65.131.41.15:995
72.190.101.70:443
24.53.49.240:2222
5.12.0.239:443
96.237.141.134:995
37.210.186.213:61201
98.26.50.62:995
173.245.152.231:443
78.96.199.79:443
74.56.167.31:443
199.116.241.147:443
94.52.68.72:443
96.30.198.161:443
95.179.247.224:443
108.5.34.248:443
199.247.16.80:443
24.231.54.185:2222
92.59.35.196:2222
110.159.189.54:443
72.204.242.138:20
207.255.161.8:443
207.255.161.8:2087
207.255.161.8:32103
72.204.242.138:53
69.123.116.167:2222
93.113.177.152:443
68.46.142.48:995
47.146.169.85:443
79.118.120.51:2222
74.75.216.202:443
173.22.125.129:2222
200.75.136.78:443
80.14.209.42:2222
84.78.128.76:2222
86.122.241.39:2222
72.209.191.27:443
185.246.9.69:995
71.221.92.98:443
71.12.214.209:2222
80.240.26.178:443
108.30.125.94:443
190.85.91.154:443
67.60.113.253:2222
75.87.161.32:995
203.198.96.200:443
71.197.126.250:443
66.222.88.126:995
47.146.32.175:443
200.124.231.21:443
24.201.79.208:2078
24.234.86.201:995
73.228.1.246:443
172.78.30.215:443
2.90.109.29:995
134.0.196.46:995
178.222.113.168:995
77.159.149.74:443
41.44.218.243:995
95.76.109.181:443
39.36.105.140:995
188.247.252.243:443
72.82.15.220:443
166.62.180.194:2078
103.76.160.110:443
103.110.49.88:443
70.124.29.226:443
2.50.112.11:20
47.44.217.98:443
216.201.162.158:443
89.42.142.35:443
71.126.139.251:443
71.84.5.114:995
108.178.66.82:995
134.228.24.29:443
76.170.77.99:995
184.98.103.204:995
108.185.113.12:443
96.41.93.96:443
216.163.4.136:443
96.18.240.158:443
66.215.32.224:443
35.134.202.234:443
181.91.255.26:443
117.218.208.239:443
72.204.242.138:32102
144.139.47.206:443
207.255.161.8:465
45.32.155.12:443
59.99.37.23:443
66.208.105.6:443
71.187.170.235:443
68.174.15.223:443
207.255.161.8:32100
207.255.161.8:2078
98.22.65.76:443
68.174.9.179:443
67.165.206.193:993
72.204.242.138:465
107.77.236.109:0
69.11.247.242:443
75.81.25.223:443
207.255.18.67:443
103.206.112.234:443
50.232.172.114:443
75.136.40.155:443

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e6e67623e24b8c95021d63966ac7f2ba20e7fbe9495b32290871fc9fa8fe4fe3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/63495/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample