MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7e9e9ede8090e5bcf5ee8341f4540c21ace2e419b0d3a766c5e460313ca4328. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 12


Intelligence 12 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e7e9e9ede8090e5bcf5ee8341f4540c21ace2e419b0d3a766c5e460313ca4328
SHA3-384 hash: 9c0cc6ed7644247546dffa6007ebcc6d0780c32c0bd0a242cd59279735a584cd9a6b0a38d6e5012b4ab56400d79efa6c
SHA1 hash: 0ffdef91c6f84d4bb63ab7a7e5b7799e5924772f
MD5 hash: f4def11ae4014fbf7dec2e4563c572a1
humanhash: sad-muppet-idaho-sierra
File name:762047.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:596'808 bytes
First seen:2023-02-15 16:38:23 UTC
Last seen:2023-02-15 18:31:45 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash bfe106568f1a319f9d6a1481ab72d3aa (7 x Quakbot)
ssdeep 12288:fZa7ZPnVubJS4NjeWC58pyteLnr2zlSz6:he5VuY1H8pubSe
Threatray 1'971 similar samples on MalwareBazaar
TLSH T1DAC49F26B2D0C833D2632A7C9D2BA75C983ABE512928DC466FE81D4C5F3938135763D7
TrID 47.6% (.EXE) Win32 Executable Delphi generic (14182/79/4)
15.1% (.EXE) Win32 Executable (generic) (4505/5/1)
10.0% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
6.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter k3dg3___
Tags:dll obama240 qbot Quakbot TA570

Intelligence

File Origin
# of uploads :
2
# of downloads :
249
Origin country :
US US
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/366779/
Detection(s):
SecuriteInfo.com.Win32.BotX-gen.31403.11257.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Сreating synchronization primitives
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
60%
Tags:
greyware keylogger overlay packed
Link:
https://www.filescan.io/uploads/63ed0aa645632f5c85b391b7/reports/c7b53c37-3b6d-4110-a5fa-23bb46dedeef/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/e7e9e9ede8090e5bcf5ee8341f4540c21ace2e419b0d3a766c5e460313ca4328
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f1db8e22-40f9-4281-8652-d911890bfea4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e7e9e9ede8090e5bcf5ee8341f4540c21ace2e419b0d3a766c5e460313ca4328/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2023-02-15 16:39:07 UTC
File Type:
PE (Dll)
Extracted files:
38
AV detection:
20 of 25 (80.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=47u6t3pibehfxt265a2b6rkayinm4lsbtmgtu5tmlzdage6kimua._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
0415ef433261d715e36a1d6497ebe78dd1fb7dcc45e018e5a95def1572e47272
Quakbot
402dc9f0deb84bc6a911e6a13a953a6049e9eb79203968ca5cb123b21dd349f4
Quakbot
476e834197ac6cd3080059d86a8a2a49e31212ed75e0d68e4e21fcc3bc6b1d8b
Quakbot
5d139b4f25ad0cbc6e9a81573520519a70079581869f63fce35434e7b095a4b4
Quakbot
60eeaf8a513588721d79654147873245acf8e74ede677707e370acf1782148c9
Quakbot
70d8f263a41bc7606968ed192e027338c7ff63a1dc80675b039cfac2861bcebc
Quakbot
88fae62ee9c09b67123d42a4ddc9dce679e5508668b60d2a3d869578bc652ad8
Quakbot
e16e0faae0e9851a782d026f6692e34a9c7bae14c545aa8ac1e1ef033dfd06a8
Quakbot
e99726f967f112c939e4584350a707f1a3885c1218aafa0f234c4c30da8ba2af
Quakbot
+ 1'961 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama240 campaign:1676465313 banker stealer trojan
Link:
https://tria.ge/reports/230215-t5ye5sce9w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Program crash
Qakbot/Qbot
Malware Config
C2 Extraction:
87.221.197.113:2222
76.20.42.45:443
86.207.227.152:2222
109.11.175.42:2222
41.228.236.143:995
51.37.173.153:443
24.206.27.39:443
116.72.250.18:443
80.3.209.218:443
82.36.36.76:443
12.172.173.82:2087
176.142.207.63:443
66.35.126.223:2222
12.172.173.82:995
24.239.69.244:443
68.108.122.180:443
173.18.126.3:443
156.216.125.255:995
24.71.120.191:443
73.165.119.20:443
41.230.174.134:443
90.104.22.28:2222
74.33.196.114:443
121.121.100.207:995
81.157.227.223:2222
12.172.173.82:20
67.187.130.101:443
172.248.42.122:443
85.85.34.201:993
82.11.242.219:443
93.156.99.48:443
84.35.26.14:995
216.151.184.116:443
12.172.173.82:465
50.68.204.71:993
12.172.173.82:990
12.172.173.82:21
45.50.233.214:443
89.79.229.50:443
47.34.30.133:443
70.27.104.2:2222
47.21.51.138:443
116.75.63.211:443
149.74.159.67:2222
202.142.98.62:995
103.42.86.110:995
103.123.223.76:443
92.27.86.48:2222
213.67.255.57:2222
125.99.69.178:443
193.253.100.236:2222
47.149.78.242:443
71.112.212.166:443
94.3.71.196:443
103.212.19.254:995
217.165.186.116:2222
46.27.231.50:2078
86.96.72.139:2222
64.237.185.60:443
188.83.248.76:443
2.50.48.213:443
85.152.152.46:443
77.86.98.236:443
217.128.91.196:2222
2.13.73.146:2222
27.109.19.90:2078
94.30.98.134:32100
86.128.15.66:2222
86.195.14.72:2222
86.250.12.217:2222
98.37.25.99:443
188.49.125.169:995
86.202.48.142:2222
103.252.7.231:443
86.225.214.138:2222
95.255.60.223:995
74.92.243.113:50000
90.213.146.227:443
92.186.69.229:2222
104.35.24.154:443
201.244.108.183:995
190.75.132.158:2222
184.176.35.223:2222
190.11.198.75:443
82.212.115.188:443
205.164.227.222:443
87.223.82.41:443
88.126.94.4:50000
37.14.229.220:2222
85.59.61.52:2222
147.219.4.194:443
76.80.180.154:995
79.67.165.149:995
103.144.201.53:2078
72.80.7.6:995
87.149.176.97:443
27.0.48.205:443
209.142.97.83:995
47.21.51.138:995
88.126.112.14:50000
91.171.148.162:50000
93.24.192.142:20
185.107.56.214:32100
89.32.157.195:995
89.152.120.181:443
50.68.204.71:995
86.169.203.116:443
81.229.117.95:2222
69.133.162.35:443
92.154.17.149:2222
2.50.137.46:995
181.164.217.211:443
213.31.90.183:2222
198.2.51.242:993
88.111.182.118:2222
71.52.53.166:443
12.172.173.82:32101
27.99.45.237:2222
75.143.236.149:443
85.61.165.153:2222
Unpacked files
SH256 hash:
8c8e4d408f0a903c71e60b6f13d89e025ecb92577728676f67fc4fd7871cf736
MD5 hash:
e3ad604262a9348d52d0719e3c03e858
SHA1 hash:
094f8c570816162c44f4666d1bcdc73e98654e10
Link:
https://www.unpac.me/results/c75964bd-ca72-42ff-908d-ff14bf9fef2b/
SH256 hash:
9ad0cfa8bc3686c514ec19260593e0a89e8f0411e5fc40179bc03376f7526d0b
MD5 hash:
bbc17a0e87fc578847886b73687d9845
SHA1 hash:
e1d4688995c04d3d346adffe09fe5d4f33142c36
Detections:
Qakbot
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/c75964bd-ca72-42ff-908d-ff14bf9fef2b/
Parent samples :
f29c24fceb5dd166b473d60785cf775c0b8e11380a4d237096cd99401c801d02
402dc9f0deb84bc6a911e6a13a953a6049e9eb79203968ca5cb123b21dd349f4
e7e9e9ede8090e5bcf5ee8341f4540c21ace2e419b0d3a766c5e460313ca4328
SH256 hash:
e7e9e9ede8090e5bcf5ee8341f4540c21ace2e419b0d3a766c5e460313ca4328
MD5 hash:
f4def11ae4014fbf7dec2e4563c572a1
SHA1 hash:
0ffdef91c6f84d4bb63ab7a7e5b7799e5924772f
Link:
https://www.unpac.me/results/c75964bd-ca72-42ff-908d-ff14bf9fef2b/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e7e9e9ede809/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e7e9e9ede8090e5bcf5ee8341f4540c21ace2e419b0d3a766c5e460313ca4328

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:qakbot_api_hashing
Create hunting rule
Author:@Embee_Research
Reference:https://twitter.com/embee_research/status/1592067841154756610
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:unpacked_qbot
Create hunting rule
Description:Detects unpacked or memory-dumped QBot samples
Rule name:Windows_Trojan_Qbot_1ac22a26
Create hunting rule
Author:Elastic Security
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.
Rule name:win_qakbot_malped
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Quakbot

Microsoft OneNote (one) one b69ce5e5977885bb314aa26dd4a56052fdf4b030f1c66a8a52ad90e80bc39fac

Quakbot

DLL dll e7e9e9ede8090e5bcf5ee8341f4540c21ace2e419b0d3a766c5e460313ca4328

(this sample)

  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/366779/
  
Dropped by
SHA256 b69ce5e5977885bb314aa26dd4a56052fdf4b030f1c66a8a52ad90e80bc39fac
  
Dropped by
MD5 b43c40200a9558e404585b8976698003

Comments