MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb9915d87fd32bf37ff5e764a80b6fb4957598433774ae9fed10f82d932dba0c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	eb9915d87fd32bf37ff5e764a80b6fb4957598433774ae9fed10f82d932dba0c
SHA3-384 hash:	93e7f0c336182cf5dd005c15e3b904aeb856e96b031160cb3f983e9498cd8172f3e73a4756dd84b6a1c8502fc94673e7
SHA1 hash:	9b95a16c453f607a9931f8e1588d634c0a2fa637
MD5 hash:	8eb6220a63a6354be35e520903c11d7f
humanhash:	snake-kilo-floor-cardinal
File name:	fsoevv.exe
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	1'094'120 bytes
First seen:	2020-11-11 18:12:26 UTC
Last seen:	2020-11-11 19:45:32 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	ba5c263c6125faae2c597950f7826711 (27 x Quakbot)
ssdeep	12288:PqflDDoYeF20NNHCW8k45hox9l7pUHiX6EQ2XbhI:P00E0NNHCWZmO7aHINbG
Threatray	1'091 similar samples on MalwareBazaar
TLSH	7735011BE1E35BCBE483417C69E280BAD532EF8DDB1BD46B2A18F1D871B63C5851E604
Reporter	ffforward
Tags:	exe Ilmelä Ikikesä Oy Qakbot qbot Quakbot signed

Intelligence

File Origin

# of uploads :

# of downloads :

232

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.BScope.Trojan.Cobalt.4422.UNOFFICIAL

SecuriteInfo.com.BScope.Trojan.Cobalt.27766.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a process with a hidden window

Sending a UDP request

Creating a file in the Windows subdirectories

Creating a file in the %AppData% subdirectories

Creating a process from a recently created file

Launching a process

Creating a window

Unauthorized injection to a system process

Enabling autorun by creating a file

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eb9915d87fd32bf37ff5e764a80b6fb4957598433774ae9fed10f82d932dba0c/

Threat name:

Win32.Trojan.QBot

Status:

Malicious

First seen:

2020-11-11 18:35:37 UTC

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5omrlwd72mv7g77v45skqc3pwskxlgcdg52k5h7ncd4c3eznxiga._file

Verdict:

malicious

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:abc029 campaign:1605085287 banker stealer trojan

Link:

https://tria.ge/reports/201111-tr7ntnks46/

Behaviour

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Loads dropped DLL

Executes dropped EXE

Qakbot/Qbot

Malware Config

C2 Extraction:

24.27.82.216:2222
86.122.246.127:2222
151.73.126.156:443
176.181.247.197:443
85.186.115.172:995
94.49.131.37:443
41.205.16.176:443
86.121.137.204:2222
217.162.149.212:443
63.155.67.114:995
212.70.107.59:995
2.50.143.154:2222
73.166.10.38:443
84.232.252.202:2222
50.82.55.69:443
47.146.39.147:443
69.40.22.180:443
73.239.229.107:995
71.187.177.20:443
86.97.191.98:2222
50.244.112.90:443
101.185.161.151:2222
119.153.110.160:443
2.181.78.140:2222
2.50.110.49:2078
72.241.205.69:443
47.22.148.6:443
45.118.65.34:443
81.133.234.36:2222
93.113.177.152:443
105.101.2.186:443
68.186.192.69:443
71.187.170.235:443
180.233.150.134:443
196.204.207.111:443
175.140.251.128:443
81.214.126.173:2222
46.53.21.97:443
72.204.242.138:443
96.241.66.126:443
92.137.138.52:2222
85.97.87.45:443
199.247.22.145:443
75.136.40.155:443
45.63.107.192:995
45.63.107.192:2222
149.28.99.97:443
45.63.107.192:443
149.28.99.97:995
207.246.75.201:443
200.75.136.78:443
45.32.154.10:443
80.240.26.178:443
149.28.99.97:2222
120.151.95.167:443
190.220.8.10:995
118.100.108.25:443
93.86.252.177:995
173.245.152.231:443
83.110.12.0:2222
120.151.10.50:2222
37.210.133.110:443
41.206.131.166:443
79.131.182.35:2222
41.225.13.128:8443
196.151.252.84:443
173.70.165.101:995
69.47.26.41:443
73.2.215.84:443
5.14.113.82:443
2.51.247.69:995
77.159.149.74:443
188.25.24.21:2222
68.174.15.223:443
92.154.83.96:2222
197.57.95.152:443
199.247.16.80:443
203.106.195.67:443
146.199.132.233:2222
2.90.127.64:443
2.50.155.80:2222
5.15.90.117:2222
189.231.189.64:443
24.122.0.90:443
58.179.21.147:995
149.135.101.20:443
82.127.125.209:22
109.209.94.165:2222
79.113.242.120:443
82.76.47.211:443
2.51.38.2:443
122.60.99.107:443
96.21.251.127:2222
84.117.176.32:443
98.116.20.194:443
5.32.41.46:443
89.137.211.239:443
172.91.19.192:443
27.223.92.142:995
83.110.226.174:443
198.2.35.226:2222
217.133.54.140:32100
197.51.82.115:995
59.96.164.27:443
197.161.154.132:443
72.29.181.78:2222
87.27.110.90:2222
185.246.9.69:995
47.44.217.98:443
41.228.35.129:443
94.52.160.116:443
96.30.198.161:443
24.205.42.241:443
45.63.104.123:443
45.32.162.253:443
95.179.247.224:443
24.90.129.73:443
140.82.27.132:443
207.246.70.216:443
45.32.165.134:443
108.30.125.94:443
120.150.34.178:443
79.172.26.240:443
47.40.78.73:443
74.135.122.35:443
72.36.59.46:2222
108.31.15.10:995
121.58.199.24:443
184.66.18.83:443
86.97.162.141:2222
73.55.254.225:443
184.98.97.227:995
216.215.77.18:2222
65.24.81.79:443
144.139.230.139:443
201.103.137.140:443
197.86.204.198:443
59.96.164.126:443
24.137.76.62:995
185.105.131.233:443
117.199.2.194:443
92.59.35.196:2083
81.88.254.62:443
86.248.30.56:2222
37.106.36.31:995
83.110.205.199:443
156.205.170.226:995
71.238.211.125:443
180.181.49.68:995

Unpacked files

SH256 hash:

eb9915d87fd32bf37ff5e764a80b6fb4957598433774ae9fed10f82d932dba0c

MD5 hash:

8eb6220a63a6354be35e520903c11d7f

SHA1 hash:

9b95a16c453f607a9931f8e1588d634c0a2fa637

Link:

https://www.unpac.me/results/5d02cb32-d416-48c3-a0f7-38c240cf02a7/

SH256 hash:

de6a1d682218abbf39d7844807eecb4742e4c771b249a7eaec3c3edacf3241e0

MD5 hash:

e95eb07503a7aa850c2fa406768d8908

SHA1 hash:

a3bb5646b8be8e4d624a8d61fe4cd8b7406bec5f

Detections:

win_qakbot_g0

win_qakbot_auto

Link:

https://www.unpac.me/results/5d02cb32-d416-48c3-a0f7-38c240cf02a7/

SH256 hash:

22a5f7747bbe1b7e35ed9271470d0622872340be9d63ab809bf438d7e976153a

MD5 hash:

1d862a50217a4163bcf0f77f1ade0cb3

SHA1 hash:

b460f0cf9396434570f82d505ccaf3179e226df5

Detections:

win_qakbot_auto

Link:

https://www.unpac.me/results/5d02cb32-d416-48c3-a0f7-38c240cf02a7/

Parent samples :

b62204e7ac2de6eb620fc2849593ab3bf50132836a5b648d572fd728c2404e72
eb9915d87fd32bf37ff5e764a80b6fb4957598433774ae9fed10f82d932dba0c
cebb5bb7177a20961e79e4609e2789adec6b38a9d91269794f9fcbed6fea73af
5c6f9bba14dfb1e7b6a8dd697ae6ba69181d5af7cccf6dd40b89516d5ea483c3
54143d46ffc8e27ed096659781ace6b86d64e60c6824a59104816f6b2eab0905
9003653bd1f19432eb423ccf719c2de2189663b4240704d9eef95144945b348f

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QakBot Create hunting rule
Author:	kevoreilly
Description:	QakBot Payload

Rule name:	Select_from_enumeration Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	win_qakbot_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	autogenerated rule brought to you by yara-signator