MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2f87129d1786fd86f0ec659457aae0e186c023a19f63d207c17b28dc63ae2e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	f2f87129d1786fd86f0ec659457aae0e186c023a19f63d207c17b28dc63ae2e9
SHA3-384 hash:	1089165655c56bb9565b8f79ee585d8eebd61cc128b31d4058bc4cedfba7ed1384567011984b31224fbc9cd8910b8b93
SHA1 hash:	572b71758bc7681f1be919792b6b3e5a475399ea
MD5 hash:	0935126f164f7e80eda4b907c76bdf29
humanhash:	four-idaho-sad-oklahoma
File name:	1.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	1'228'800 bytes
First seen:	2022-04-12 10:56:53 UTC
Last seen:	2022-04-12 11:43:56 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	b18e67cf395fc2f9d1d9dd12d529171f (1 x Quakbot)
ssdeep	24576:dftEDK1snL/1mofDWHI/NeOmF4wblkilHTduRrirdAL303I13UqWSQewPE+RI8zc:
Threatray	440 similar samples on MalwareBazaar
TLSH	T19445AFFC76047DD6E66F467BDE96ACDD13B626329AC7A4CC806477C30963362EE02805
Reporter	PO3T1985
Tags:	dll Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

385

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/262960/

Detection(s):

SecuriteInfo.com.Trojan.Autoruns.GenericKDS.39480207.15237.4509.UNOFFICIAL

Result

Verdict:

Suspicious

Maliciousness:

Behaviour

Sending a custom TCP request

Сreating synchronization primitives

Launching a process

Searching for synchronization primitives

Creating a window

Creating a file in the system32 subdirectories

Unauthorized injection to a system process

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

qakbot qbot

Link:

https://www.filescan.io/uploads/62555b02eab80a7a6cffd2ce/reports/c40cbfd2-f0ed-47df-aaac-e41da0ad5e44/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/10a5542d-b1b4-4db6-9fd8-64d5218eb862

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f2f87129d1786fd86f0ec659457aae0e186c023a19f63d207c17b28dc63ae2e9/

Threat name:

Win32.Worm.AutoRun

Status:

Malicious

First seen:

2022-04-11 20:15:33 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

18 of 26 (69.23%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6l4hckorpbx5q3yoyzmuk6vobymgyar2dh3d2id4c6zi3rr24luq._file

Verdict:

malicious

Label(s):

qakbot

Quakbot

1cdad75e7830e4ae946bb26c15be354676820710c2471d9ea6d24926fc0df86f

Quakbot

73f5c306c33c980fcd85f185af9c2a2b7678eebda5b10ec072558bd74dd776af

Quakbot

80d48eb263fe58d5a0afaa20679c5824c9f5fdce8a6707e5c9ef3c8817011938

Quakbot

934cb585f33fe11bcd0e99f4df40de07eec50aae0c6d036527fc03fe6d7d0fc8

Quakbot

b111a710a0a9f11092e94035e9609266d1a69b4aa7031c6d67528ee106d36216

Quakbot

dc9e4fb434d9be18748858c4daa2744931a60c645ec913b76719b19e634ce665

Quakbot

df8d431b3d7193b0d0d6667b269ef1b2431086343bf86a41c3a2a2488d9f1567

Quakbot

eb14763a3242cfc46ea26a42f68dec0f08488b12adb9590aebd142844de903a4

Quakbot

+ 430 additional samples on MalwareBazaar

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:aa campaign:1649660590 banker stealer trojan

Link:

https://tria.ge/reports/220412-m188hsaggp/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Qakbot/Qbot

Malware Config

C2 Extraction:

41.228.22.180:443
47.23.89.62:995
176.67.56.94:443
103.107.113.120:443
148.64.96.100:443
47.180.172.159:443
181.118.183.98:443
140.82.49.12:443
103.87.95.133:2222
96.21.251.127:2222
197.167.62.14:993
46.107.48.202:443
24.43.99.75:443
172.115.177.204:2222
80.11.74.81:2222
66.98.42.102:443
75.99.168.194:61201
173.174.216.62:443
45.9.20.200:443
39.41.158.185:995
187.207.48.194:61202
41.84.237.10:995
93.48.80.198:995
105.226.83.196:995
144.202.2.175:443
45.76.167.26:995
144.202.3.39:443
144.202.3.39:995
140.82.63.183:443
45.63.1.12:995
140.82.63.183:995
144.202.2.175:995
45.63.1.12:443
149.28.238.199:443
45.76.167.26:443
149.28.238.199:995
47.180.172.159:50010
71.13.93.154:2222
86.98.33.141:443
31.35.28.29:443
113.11.89.165:995
175.145.235.37:443
117.248.109.38:21
94.59.138.62:2222
32.221.224.140:995
5.95.58.211:2087
81.215.196.174:443
176.88.238.122:995
94.59.138.62:1194
92.132.172.197:2222
70.46.220.114:443
78.87.206.213:995
197.89.108.252:443
39.44.144.159:995
176.205.119.81:2078
91.177.173.10:995
72.76.94.99:443
24.178.196.158:2222
1.161.71.109:995
172.114.160.81:995
173.21.10.71:2222
1.161.71.109:443
86.97.11.43:443
217.128.122.65:2222
86.98.33.141:995
203.122.46.130:443
89.211.181.64:2222
37.186.54.254:995
86.98.208.214:2222
83.110.75.97:2222
202.134.152.2:2222
120.150.218.241:995
45.46.53.140:2222
180.129.102.214:995
217.164.210.192:443
217.165.147.83:993
84.241.8.23:32103
180.183.128.80:2222
74.15.2.252:2222
76.70.9.169:2222
47.23.89.62:993
75.113.214.234:2222
208.107.221.224:443
76.169.147.192:32103
190.73.3.148:2222
76.69.155.202:2222
96.29.208.97:443
108.60.213.141:443
75.99.168.194:443
182.191.92.203:995
73.151.236.31:443
38.70.253.226:2222
39.52.75.201:995
121.74.167.191:995
201.211.64.196:2222
71.74.12.34:443
191.99.191.28:443
85.246.82.244:443
101.50.103.193:995
182.253.189.74:2222
67.209.195.198:443
90.120.65.153:2078
37.34.253.233:443
96.37.113.36:993
181.62.0.59:443
41.38.167.179:995
197.205.127.234:443
45.241.232.25:995
185.69.144.209:443
2.50.137.197:443
73.67.152.98:2222
76.25.142.196:443
125.168.47.127:2222
201.145.189.252:443
109.12.111.14:443
102.182.232.3:995
72.12.115.90:22
47.156.191.217:443
174.69.215.101:443
70.51.138.126:2222
186.105.121.166:443
179.158.105.44:443
94.36.195.250:2222
109.228.220.196:443
120.61.2.95:443
103.88.226.30:443
103.139.243.207:990
68.204.7.158:443
196.233.79.3:80
39.57.76.82:995
187.250.114.15:443
103.246.242.202:443
190.252.242.69:443
5.32.41.45:443
100.1.108.246:443
72.252.201.34:995
191.17.223.93:32101
40.134.246.185:995
187.102.135.142:2222
191.34.199.129:443
181.208.248.227:443
138.204.24.70:443
209.197.176.40:995
42.235.146.7:2222
82.152.39.39:443
41.230.62.211:993
31.48.166.122:2078
187.251.132.144:22
143.0.34.185:443
88.228.250.126:443

Unpacked files

SH256 hash:

f2f87129d1786fd86f0ec659457aae0e186c023a19f63d207c17b28dc63ae2e9

MD5 hash:

0935126f164f7e80eda4b907c76bdf29

SHA1 hash:

572b71758bc7681f1be919792b6b3e5a475399ea

Link:

https://www.unpac.me/results/7782b5bb-6574-4892-b9c6-219bc6e669ef/

Malware family:

QBot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/f2f87129d178/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.61

Link:

https://yomi.yoroi.company/submissions/f2f87129d1786fd86f0ec659457aae0e186c023a19f63d207c17b28dc63ae2e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.