MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb07ade8a791a70f5bb93fb686ceda74c5c229780837764dd343102b9fce7535. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 7

Intelligence 7 IOCs YARA File information Comments

SHA256 hash:	eb07ade8a791a70f5bb93fb686ceda74c5c229780837764dd343102b9fce7535
SHA3-384 hash:	e29d58e2857e0cfeb14e630957ba6285cdc4d150c1337399829b589d72a043e70a57aa640a5b1f69605c1e0d6d87410e
SHA1 hash:	fb50c2badf8383908d91e482fbfba20161468135
MD5 hash:	e223a5380a4a2a24becf5a2c3c864f77
humanhash:	earth-mississippi-gee-robert
File name:	44470.4130951389.dat
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	586'752 bytes
First seen:	2021-10-01 15:37:31 UTC
Last seen:	2021-10-01 17:03:44 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	d42fd5a2673ce9bf677ede14c236a61e (2 x Quakbot)
ssdeep	12288:Z87H3sH2k/e89A9tqKsuud0Hl0pT7fEztxG9HBMbVNAbirS:ZSs7/7YtqoE3MzO9HoHws
Threatray	202 similar samples on MalwareBazaar
TLSH	T1DCC46D407A55E822E2AC19318E2AE5F807587D099FBD64CF7AE02F0F2A794D3C635717
Reporter	nokae8
Tags:	dll obama107 Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

263

Origin country :

n/a

Vendor Threat Intelligence

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/194024/

Detection(s):

SecuriteInfo.com.Variant.Babar.28762.18959.16575.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Launching the default Windows debugger (dwwin.exe)

Malware family:

Qakbot

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/5137cec8-a1cf-40c5-ad9a-871125e6f541

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eb07ade8a791a70f5bb93fb686ceda74c5c229780837764dd343102b9fce7535/

Threat name:

Win32.Worm.Cridex

Status:

Malicious

First seen:

2021-10-01 15:38:06 UTC

AV detection:

7 of 45 (15.56%)

Threat level:

5/5

Verdict:

malicious

Label(s):

qakbot

gozi

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:obama107 campaign:1633078880 banker evasion stealer trojan

Link:

https://tria.ge/reports/211001-s22sqacaf3/

Behaviour

Creates scheduled task(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Loads dropped DLL

Qakbot/Qbot

Windows security bypass

Malware Config

C2 Extraction:

140.82.49.12:443
41.250.143.109:995
216.201.162.158:443
86.8.177.143:443
105.198.236.99:443
124.123.42.115:2222
217.17.56.163:443
37.210.152.224:995
190.198.206.189:2222
75.89.195.186:995
78.191.44.76:995
122.11.220.212:2222
68.186.192.69:443
159.2.51.200:2222
217.17.56.163:2222
217.17.56.163:2078
41.228.22.180:443
120.151.47.189:443
47.22.148.6:443
94.200.181.154:443
81.241.252.59:2078
76.25.142.196:443
89.101.97.139:443
217.17.56.163:0
185.250.148.74:443
174.54.58.170:443
73.130.180.25:443
73.52.50.32:443
174.59.35.191:443
181.118.183.94:443
120.150.218.241:995
73.230.205.91:443
174.54.193.186:443
136.232.34.70:443
71.74.12.34:443
95.77.223.148:443
103.148.120.144:443
75.188.35.168:443
39.52.213.1:995
45.46.53.140:2222
73.151.236.31:443
173.21.10.71:2222
24.34.58.116:443
62.23.194.38:443
62.23.194.41:995
47.40.196.233:2222
67.165.206.193:993
72.252.201.69:443
173.25.166.81:443
199.27.127.129:443
68.204.7.158:443
191.191.38.8:443
109.12.111.14:443
24.139.72.117:443
24.229.150.54:995
189.210.115.207:443
174.59.226.6:443
73.130.237.36:443
81.250.153.227:2222
69.253.197.100:443
174.59.242.9:443
177.130.82.197:2222
67.214.30.12:995
24.55.112.61:443
174.59.120.69:443
47.181.84.61:443
73.130.239.166:443
103.157.122.198:995
217.165.163.21:995
77.57.204.78:443
93.8.66.216:443
73.52.114.202:443
186.18.205.199:995
38.10.202.214:443
78.191.44.76:443
96.83.180.29:443
124.123.42.115:2078
105.159.144.186:995
27.223.92.142:995
109.190.253.11:2222
217.17.56.163:465
38.10.201.211:443
92.148.59.207:2222
92.157.171.41:2222
186.87.135.68:995
80.6.192.58:443
75.66.88.33:443
187.156.138.172:443
82.77.137.101:995
173.234.155.233:443
2.178.116.91:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222

Unpacked files

SH256 hash:

495565bbefa753a072be03f3953725ff93da4fa7ef79f58c4df1890c80a2583a

MD5 hash:

54ec58b78ed2ec8a18f13623d17b93d5

SHA1 hash:

303515ed666ed75ebed7e86944219d488febe8f0

Link:

https://www.unpac.me/results/7d830e37-4ff5-4ed7-9795-4aefe4f49ea1/

SH256 hash:

b90abba230a1733969b880945e57f0da485d7447ce561ba7f11d8de1ac782b50

MD5 hash:

20b8e11c27f155ddbc22e6be0c7f618a

SHA1 hash:

c00c0f5b33e89896e48132e8dcea0c0dd8f032e2

Link:

https://www.unpac.me/results/7d830e37-4ff5-4ed7-9795-4aefe4f49ea1/

SH256 hash:

eb07ade8a791a70f5bb93fb686ceda74c5c229780837764dd343102b9fce7535

MD5 hash:

e223a5380a4a2a24becf5a2c3c864f77

SHA1 hash:

fb50c2badf8383908d91e482fbfba20161468135

Link:

https://www.unpac.me/results/7d830e37-4ff5-4ed7-9795-4aefe4f49ea1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/eb07ade8a791a70f5bb93fb686ceda74c5c229780837764dd343102b9fce7535

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Quakbot

DLL dll eb07ade8a791a70f5bb93fb686ceda74c5c229780837764dd343102b9fce7535

(this sample)

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/194024/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample