🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e9553ac49999a213ddf6001564a5cb87225f2b5b91cb201c8a415f8dbb1eb623. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e9553ac49999a213ddf6001564a5cb87225f2b5b91cb201c8a415f8dbb1eb623
SHA3-384 hash: 001f337b8884014764ab4e840abbf7279fa696b09ea2e8c577aeacaa88bfa5de178a1bf72c80afe121146c86717ab6f6
SHA1 hash: 45c378524ef3afbd7cca29c3d5a84a5139b8ef0b
MD5 hash: 32e0d809c346c7e586cc728ef95ced4e
humanhash: whiskey-princess-johnny-cold
File name:9080975043158770.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:1'097'200 bytes
First seen:2022-02-15 16:26:43 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 220ea7972e993d1cdbf761cab8a71a9d (11 x Quakbot)
ssdeep 24576:JuwgYKvPteX5lNEZYy7PKFYY22OlWc971Zkqtu2K0FCFFi:Azle6Pa122S9k2Kq
Threatray 11 similar samples on MalwareBazaar
TLSH T1CB358D3271C1D5BFC4B236BCAD6A71A988257D521D2CCC0DBBD80F4E0D7A691673229E
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (573 x Quakbot, 339 x GCleaner, 137 x ArkeiStealer)
Reporter k3dg3___
Tags:dll qbot Quakbot signed TA570

Code Signing Certificate

Organisation:HOUSE 9A s.r.o
Issuer:Sectigo Public Code Signing CA R36
Algorithm:sha384WithRSAEncryption
Valid from:2021-12-30T00:00:00Z
Valid to:2022-12-30T23:59:59Z
Serial number: d3aee8abb9948844a3ac1c04cc7e6bdf
Intelligence: 10 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: e386450257e170981513b7001a82fb029f0931e5c2f11c6d9b86660da0b89a66
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
211
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/241667/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Creating a window
Unauthorized injection to a system process
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware overlay packed
Link:
https://www.filescan.io/uploads/620bd459a2660f3bb9dc4a99/reports/d85beb56-930d-4fca-a10a-19183c25d417/overview
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/b3c55eee-1d9c-431e-b59f-7aa3dce096b7
Result
Threat name:
CryptOne Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/940243
Signature
Allocates memory in foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Schedule system process
Sigma detected: Suspicious Call by Ordinal
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected CryptOne packer
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 572723 Sample: 9080975043158770.dat Startdate: 15/02/2022 Architecture: WINDOWS Score: 100 55 Multi AV Scanner detection for submitted file 2->55 57 Yara detected CryptOne packer 2->57 59 Yara detected Qbot 2->59 61 4 other signatures 2->61 8 loaddll32.exe 1 2->8         started        11 regsvr32.exe 2->11         started        13 regsvr32.exe 2->13         started        process3 signatures4 63 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 8->63 65 Injects code into the Windows Explorer (explorer.exe) 8->65 67 Writes to foreign memory regions 8->67 69 2 other signatures 8->69 15 explorer.exe 8 1 8->15         started        19 cmd.exe 1 8->19         started        21 regsvr32.exe 11->21         started        23 regsvr32.exe 13->23         started        process5 file6 41 C:\Users\user\Desktop\9080975043158770.dll, PE32 15->41 dropped 43 Uses schtasks.exe or at.exe to add and modify task schedules 15->43 25 schtasks.exe 1 15->25         started        27 rundll32.exe 19->27         started        45 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 21->45 47 Injects code into the Windows Explorer (explorer.exe) 21->47 49 Writes to foreign memory regions 21->49 29 explorer.exe 1 21->29         started        51 Allocates memory in foreign processes 23->51 53 Maps a DLL or memory area into another process 23->53 31 explorer.exe 23->31         started        signatures7 process8 process9 33 conhost.exe 25->33         started        35 WerFault.exe 23 9 27->35         started        37 explorer.exe 27->37         started        39 reg.exe 29->39         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e9553ac49999a213ddf6001564a5cb87225f2b5b91cb201c8a415f8dbb1eb623/
Threat name:
Win32.Infostealer.QBot
Create hunting rule
Status:
Malicious
First seen:
2022-02-15 16:27:10 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
14 of 42 (33.33%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
224b3d58500a108f6e4eaaf685bfe9c7d01e4a7e6d29cd271938ef2471ea963a
Quakbot
790951787b259b98ea0f3b7face9c805643bd5e36b2d8a9d92d6d20a7107971b
Quakbot
82c0e1fadff42149e37485a8ced86bbc67789ccc953ae5416f04a9aa23d43d1f
Quakbot
bcdecf8b43d8ed3c3faff97989ddf1aea315b4dd8c6db67f012b1b10b45bc7f4
Quakbot
c30141d6ee93bea5e69d45f4826a21edf8fc063e38d1b5eb493f1d9ef5aac213
Quakbot
d0e76eed0972833a1a977725a11aab763374f9f8b31bca82838731a8c3ecc1f2
Quakbot
d8d7d4ffaefc24dae69840816ce840570744f16d54f43fdb73d28e8456483750
Quakbot
e55a662e05fdc1e0c8570564bfcdb0d7cbec3bf5eca101ab12ac2997998c2aa9
Quakbot
ee44ca0c691190a878ec0ab55096eeb9855590d9398c95c837c6add9fac2ee32
Quakbot
eea21591ee32015987607e5a47b39f123e5bbf163d2f7b08bf66a3fa99a741a6
Quakbot
+ 1 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:obama155 campaign:1644912775 banker evasion stealer trojan
Link:
https://tria.ge/reports/220215-tx31naacar/
Behaviour
Checks processor information in registry
Creates scheduled task(s)
Enumerates system info in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Drops file in Windows directory
Loads dropped DLL
Qakbot/Qbot
Suspicious use of NtCreateProcessExOtherParentProcess
Windows security bypass
Malware Config
C2 Extraction:
32.221.231.1:443
102.65.38.67:443
120.150.218.241:995
39.44.150.120:995
31.215.116.182:2222
217.128.171.34:2222
139.64.13.189:443
95.14.104.242:995
86.98.156.45:993
196.74.174.44:443
89.101.97.139:443
212.34.15.205:443
45.9.20.200:443
75.156.151.34:443
2.50.41.69:61200
31.35.28.29:443
182.191.92.203:995
67.209.195.198:443
37.210.157.12:2222
114.79.148.170:443
96.246.158.154:995
190.73.3.148:2222
41.228.22.180:443
89.86.33.217:443
217.164.115.166:2222
188.50.238.29:995
180.233.150.134:995
89.137.52.44:443
78.87.41.5:995
66.230.104.103:443
24.53.49.240:443
37.211.176.26:61202
1.161.88.84:443
92.177.45.46:2078
24.178.196.158:2222
64.231.96.211:2222
140.82.49.12:443
128.106.122.39:443
31.215.116.182:1194
111.125.245.116:995
39.49.5.42:995
209.210.95.228:32100
181.118.183.28:443
149.135.101.20:443
103.142.10.177:443
86.98.149.75:995
86.98.10.175:995
74.15.2.252:2222
69.14.172.24:443
176.67.56.94:443
1.161.88.84:995
24.222.20.254:443
96.21.251.127:2222
103.17.101.139:995
136.143.11.232:443
76.25.142.196:443
173.21.10.71:2222
71.74.12.34:443
73.151.236.31:443
182.121.70.122:2222
75.67.73.144:443
73.59.201.174:443
70.51.137.204:2222
86.198.170.170:2222
72.252.201.34:995
100.1.108.246:443
67.165.206.193:993
72.252.201.34:990
190.206.211.182:443
78.96.235.245:443
108.4.67.252:443
109.12.111.14:443
70.45.27.254:443
75.188.35.168:443
45.46.53.140:2222
96.37.113.36:993
82.152.39.39:443
41.230.62.211:993
161.142.54.62:443
86.98.49.16:443
38.70.253.226:2222
109.51.132.148:995
76.23.237.163:995
220.255.25.1:2222
82.41.63.217:443
80.14.196.176:2222
86.97.161.184:443
86.98.156.24:32101
184.100.174.73:443
68.204.7.158:443
87.71.79.81:443
218.101.110.3:995
94.60.254.81:443
31.215.206.13:443
24.152.219.253:995
101.50.120.112:995
117.248.109.38:21
78.101.202.183:443
37.177.81.142:995
103.139.242.30:990
201.172.31.135:80
40.134.247.125:995
197.89.20.13:443
113.28.253.9:995
41.86.42.158:995
5.32.41.46:443
78.164.40.62:995
105.184.195.32:995
217.128.93.27:2222
80.6.192.58:443
136.232.34.70:443
182.176.180.73:443
39.52.217.241:995
103.139.242.30:993
75.169.34.158:443
31.215.29.238:443
173.26.188.246:443
41.84.238.71:443
23.82.128.108:443
24.95.61.62:443
144.86.6.161:443
175.137.153.178:443
70.163.1.219:443
31.215.23.29:2222
37.203.225.248:443
193.251.59.245:2222
73.136.32.202:443
86.178.220.77:443
31.215.142.105:2078
73.67.152.98:2222
43.231.252.200:443
41.209.126.246:443
37.186.54.25:995
162.210.220.137:2222
188.50.206.1:995
103.123.225.38:6881
70.50.147.95:2222
72.66.116.235:995
187.191.33.158:443
165.255.54.11:995
31.166.23.80:443
Unpacked files
SH256 hash:
1ebb18839a77e031d0b9edddda065c772e131ff4dea7dd669f5bec28a9f7186b
MD5 hash:
799b025f27586fc43f591fd0983de25d
SHA1 hash:
a05961c16fbe320f0ae5f0dbdfcedbe2017b30ba
Link:
https://www.unpac.me/results/3bc2b630-7678-448b-8cd9-b8a6c967b3a8/
SH256 hash:
e7f3d55576089a74574e444ef90e0ae6ed1f00705a52e89b4e4770763c43daed
MD5 hash:
e3c51a55bdcd74f7a71aa07c61c3ec6f
SHA1 hash:
710975b77b5900024b837938f2793a4eddad67da
Link:
https://www.unpac.me/results/3bc2b630-7678-448b-8cd9-b8a6c967b3a8/
SH256 hash:
e9553ac49999a213ddf6001564a5cb87225f2b5b91cb201c8a415f8dbb1eb623
MD5 hash:
32e0d809c346c7e586cc728ef95ced4e
SHA1 hash:
45c378524ef3afbd7cca29c3d5a84a5139b8ef0b
Link:
https://www.unpac.me/results/3bc2b630-7678-448b-8cd9-b8a6c967b3a8/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e9553ac49999a213ddf6001564a5cb87225f2b5b91cb201c8a415f8dbb1eb623

File information

The table below shows additional information about this malware sample such as delivery method and external references.

5317736060a578270772ba202316e0abea89dfe7a92f820b41eaf2989c9dfc6e

Quakbot

DLL dll e9553ac49999a213ddf6001564a5cb87225f2b5b91cb201c8a415f8dbb1eb623

(this sample)

  
Dropped by
SHA256 5317736060a578270772ba202316e0abea89dfe7a92f820b41eaf2989c9dfc6e
  
Delivery method
Distributed via e-mail link
Cape
Cape
https://www.capesandbox.com/analysis/241667/

Comments