MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee334c9cc092acc0ba59caa04044b54ffe56bbdae54c74a561f837584cc08b1c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 9


Intelligence 9 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee334c9cc092acc0ba59caa04044b54ffe56bbdae54c74a561f837584cc08b1c
SHA3-384 hash: 227b74426325cab8d93d8e3b6892e0108add48e513ff25f40977fd202a0dfdab143039ee8028c5ff5a58f1091ac7d1bf
SHA1 hash: 8083d6bfed227cb4b876415347d9b620a2ec617e
MD5 hash: 3d48534dfce5e3ae8b4282a9b80d636c
humanhash: diet-lemon-pluto-victor
File name:xxviii.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:713'216 bytes
First seen:2022-10-03 21:32:32 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash c55a71db2a0604f1aa6e10d072ecdaf3 (6 x Quakbot)
ssdeep 12288:gjLgntY7WZZdud9vUsdopaJm08L+CbbDy+SsF:gHx8sd9MsdcaJm0o1bPy+SsF
Threatray 1'451 similar samples on MalwareBazaar
TLSH T1A4E44C06B612C421C76960B22C36FAA082ACAC299EF51FD733805F778D651BB7D5DF12
TrID 29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4505/5/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter malwarelabnet
Tags:dll Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
272
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/316243/
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Searching for synchronization primitives
Modifying an executable file
Creating a window
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware qakbot qbot
Link:
https://www.filescan.io/uploads/633b550f49c58ce767c5c88c/reports/41e9f1b0-5b02-403b-82a8-dc994a03ba8e/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1d589446-3d41-4217-9b19-770a4305b4c9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee334c9cc092acc0ba59caa04044b54ffe56bbdae54c74a561f837584cc08b1c/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-10-03 17:29:48 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5yzuzhgaskwmboszzkqearfvj77fno624vghjjlb7a3vqtgarmoa._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
1965dc57456d4fc01b6ce0f242d80776fe08a16354e6177255cba618348355ac
Quakbot
1abc2fb23f55378947bf528996b50ffed195a059d5f7b537271792704eb5cd4c
Quakbot
27fbfb86936343fc18bb61811401c96c052ecdff080da3bdb403545d55cf2b2a
Quakbot
42ad1e843f44a725a6666d3d27f10caaa2252a05e1bc0b9c3c315496728f9f25
Quakbot
5b54f57dbaa74fa589afb2d26d6c6b39e0c2930bd88fea3172556ce96b3eb959
Quakbot
e3a2c056c730666fedabfed5e3cc2dee12d9c3ca36ac2d7c5289cfe29c125050
Quakbot
e91f4205e8fa14ac9acd4b6cf9a54e2fa8b3901e619e18b3fa22188ef1ddeaff
Quakbot
+ 1'441 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/221003-1d62jagdgr/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Qakbot/Qbot
Malware Config
C2 Extraction:
99.221.33.122:35602
29.202.180.222:51620
23.94.40.182:4331
34.19.16.166:1288
241.163.135.223:50051
32.107.156.85:19172
228.49.142.11:64889
196.202.140.31:7400
110.114.87.194:23019
217.188.119.28:9613
29.44.169.79:27952
169.83.63.109:46511
47.65.80.200:49855
50.140.194.100:14738
152.64.159.219:41214
12.255.117.222:36282
199.246.11.177:40851
81.180.116.241:1057
87.3.215.226:21496
247.44.83.206:32161
110.141.155.115:21355
126.7.15.81:38878
246.166.147.15:42079
71.118.48.68:16876
240.237.58.79:52135
228.135.88.101:8170
37.13.235.189:18671
187.156.210.204:4243
146.54.170.64:61188
240.132.30.162:19966
23.207.217.71:260
125.250.215.162:30167
242.193.131.8:56589
188.7.186.109:6729
80.147.52.103:32403
232.222.181.12:36938
165.107.195.136:37237
193.129.246.98:0
162.224.55.111:30915
17.105.54.14:63284
149.253.253.235:19955
148.219.182.10:5489
56.214.171.2:7637
171.182.161.115:60821
175.2.110.61:49611
99.130.91.79:29604
136.197.36.254:0
Unpacked files
SH256 hash:
2200fe87ade9550b2cf3b31e63f53dcc0f5304cd7ea7218fce61f0bc6296616a
MD5 hash:
c69f4ed7d6e4406ce3110a8c8c94e773
SHA1 hash:
43f433d8d4206de5280ff6a20dc6e373516356e4
Link:
https://www.unpac.me/results/60f6b105-312d-44a8-ac54-7c8f9e488c1f/
SH256 hash:
45b06b4ea4f9e69bfd93baf5ed1da9059ce91a6faf0c27a586d1960d1f7c709d
MD5 hash:
0e77f14378f61ce84bebb92e0797fbd8
SHA1 hash:
431ebcc88a23fa53d806dfba3f511dc8ec513438
Link:
https://www.unpac.me/results/60f6b105-312d-44a8-ac54-7c8f9e488c1f/
Parent samples :
1965dc57456d4fc01b6ce0f242d80776fe08a16354e6177255cba618348355ac
1abc2fb23f55378947bf528996b50ffed195a059d5f7b537271792704eb5cd4c
e91f4205e8fa14ac9acd4b6cf9a54e2fa8b3901e619e18b3fa22188ef1ddeaff
SH256 hash:
fe75aedc1ad25171f22409e392d1f4430ce3481c025a10665dcf71ba2ec12dc6
MD5 hash:
92080251b2a5263633570982dd201be8
SHA1 hash:
a4479eeb1e14ad69ff94f14779c6446b8b6f01c0
Link:
https://www.unpac.me/results/60f6b105-312d-44a8-ac54-7c8f9e488c1f/
SH256 hash:
ee334c9cc092acc0ba59caa04044b54ffe56bbdae54c74a561f837584cc08b1c
MD5 hash:
3d48534dfce5e3ae8b4282a9b80d636c
SHA1 hash:
8083d6bfed227cb4b876415347d9b620a2ec617e
Link:
https://www.unpac.me/results/60f6b105-312d-44a8-ac54-7c8f9e488c1f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ee334c9cc092acc0ba59caa04044b54ffe56bbdae54c74a561f837584cc08b1c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:unpacked_qbot
Create hunting rule
Description:Detects unpacked or memory-dumped QBot samples
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.
Rule name:win_qakbot_malped
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/316243/

Comments