MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f62cb5e80fdc9b25cd30ee002a9af4deadf78d6f9bbef6df22cd4a37bc6c1cf9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 12


Intelligence 12 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f62cb5e80fdc9b25cd30ee002a9af4deadf78d6f9bbef6df22cd4a37bc6c1cf9
SHA3-384 hash: f7e47f77743819dd1b4d9085bea288780d18ff3cc4eb1ac9360dc18644884162113713c77624854a6ec96bd327f983af
SHA1 hash: 72b3aa3730e4289223d3d7dbb63fa3878ebfe451
MD5 hash: 013f6f17ce0b69d8a709496ecfe9a756
humanhash: vegan-michigan-purple-oregon
File name:f62cb5e80fdc9b25cd30ee002a9af4deadf78d6f9bbef6df22cd4a37bc6c1cf9
Download: download sample
Signature Quakbot
Create hunting rule
File size:791'908 bytes
First seen:2022-10-06 19:22:21 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 9fc5700f82859d524c68c279be8dc005 (11 x Quakbot)
ssdeep 12288:zxnt9hlMvNICAY0KEkAOl7G79Ph0TF38ME:tt9+JFEkAmGAB38M
Threatray 1'485 similar samples on MalwareBazaar
TLSH T193F4AF33A2D14877D1631A7CDD3B636C94267D003B2CE94B7BE41D4D9F3A6803A6A297
TrID 47.6% (.EXE) Win32 Executable Delphi generic (14182/79/4)
15.1% (.EXE) Win32 Executable (generic) (4505/5/1)
10.0% (.MZP) WinArchiver Mountable compressed Archive (3000/1)
6.9% (.EXE) Win16/32 Executable Delphi generic (2072/23)
6.8% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 399998ecd4d46c0e (572 x Quakbot, 137 x ArkeiStealer, 82 x GCleaner)
Reporter malwarelabnet
Tags:dll Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
273
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/317399/
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.2448.5603.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Creating a window
Launching a process
Searching for synchronization primitives
Modifying an executable file
DNS request
Sending a custom TCP request
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
80%
Tags:
keylogger overlay
Link:
https://www.filescan.io/uploads/633f2b160d3d21420ccab3a4/reports/f56c46ef-62e9-4fd9-b521-f3959456cd7e/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Qakbot
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5d9fb514-0c41-4437-9f17-4e57e37ff3df
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f62cb5e80fdc9b25cd30ee002a9af4deadf78d6f9bbef6df22cd4a37bc6c1cf9/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-10-06 19:23:08 UTC
File Type:
PE (Dll)
Extracted files:
38
AV detection:
26 of 26 (100.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6ywll2ap3snsltjq5yacvgxu32w7pdlpto7pnxzczvfdppdmdt4q._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
595161418d4eae727175da894f9b6f3ec849834b79bc0162106943044fa01135
Quakbot
7b159a085f16b6f57cc7fe7ab4c30b4899602265ad030daaf051fd53db10bd1f
Quakbot
8336fd87d8f73297e6cf420ad1d3cbb980c0d238b10e08da07edb5ae43585274
Quakbot
9e51a1d3598dfbd7ad11f96be2947550e64fe2e1c3a31ebf4b3bc79b9e85f86b
Quakbot
ca28afeff6dbf19c01cfda321ebebaaee91861a29202d9a1c15809cb398326ed
Quakbot
cb786f48cda7665e5dd07e80672e0c5facb6b6300335561327b95e58029ea376
Quakbot
cfc6fef33754e68341ba3c91c6e1d569dda1466c15faeca93f80f2e587dbb079
Quakbot
e59e68973ee13a5a7525e73e48d6837ab85c9c3b129fb8df9b9519c6b3eba472
Quakbot
ea28be72dc6fda30d9e33a1a805d3dd95b88904804cb806dc39b5129e1bbd3a2
Quakbot
ee334c9cc092acc0ba59caa04044b54ffe56bbdae54c74a561f837584cc08b1c
Quakbot
+ 1'475 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/221006-x3scwsacg4/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Program crash
Qakbot/Qbot
Malware Config
C2 Extraction:
132.168.179.138:20766
26.255.76.168:3287
254.237.190.31:62182
132.152.138.73:10655
225.191.50.179:48231
230.231.229.10:5218
162.146.95.76:4069
210.171.138.163:28723
140.209.96.28:889
245.192.239.164:57833
36.194.73.27:12466
78.40.66.105:12805
75.123.208.239:20740
180.36.231.156:23458
0.32.140.49:55794
48.93.85.150:61088
61.42.19.37:48298
140.154.97.47:5036
161.111.113.177:16760
96.230.198.18:26683
73.74.2.126:52894
146.160.108.132:48359
126.30.91.173:59640
69.141.81.192:16753
225.73.134.162:51626
132.112.51.93:40962
223.99.222.199:19648
51.241.108.163:54485
190.147.59.247:15271
115.52.238.120:22318
52.31.146.86:16731
245.152.84.23:49643
94.77.21.13:22829
79.199.57.30:34908
231.98.184.102:35665
164.10.70.96:64351
8.34.249.39:4260
253.7.63.49:0
212.23.85.128:59073
89.115.21.41:31024
23.165.95.80:12178
176.226.92.22:9854
35.154.129.250:7200
173.250.166.209:61090
189.210.3.199:49760
197.245.4.245:57728
96.233.132.207:0
Unpacked files
SH256 hash:
d7acf348906ff2c99c0aece101ae5a584c976a807c6eb7eee9895211a3342b1e
MD5 hash:
d844605cc0854b06a1e14f41d0ec4f85
SHA1 hash:
ea3c6ddc54d03ab7feddef4e1d3fd198008b0a28
Link:
https://www.unpac.me/results/9da2ce3f-7a56-49f8-91ea-db84bd09005d/
SH256 hash:
fb1ed7a6e4848ff0c7b38f473ddb3110cfa0a176186fd9031fa64a98e4575750
MD5 hash:
e48f86c83fbf8d5a7280163fe1df557d
SHA1 hash:
3209676ac230aea3973a4dae02465625075643c7
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/9da2ce3f-7a56-49f8-91ea-db84bd09005d/
Parent samples :
cb786f48cda7665e5dd07e80672e0c5facb6b6300335561327b95e58029ea376
595161418d4eae727175da894f9b6f3ec849834b79bc0162106943044fa01135
9e51a1d3598dfbd7ad11f96be2947550e64fe2e1c3a31ebf4b3bc79b9e85f86b
f62cb5e80fdc9b25cd30ee002a9af4deadf78d6f9bbef6df22cd4a37bc6c1cf9
SH256 hash:
f62cb5e80fdc9b25cd30ee002a9af4deadf78d6f9bbef6df22cd4a37bc6c1cf9
MD5 hash:
013f6f17ce0b69d8a709496ecfe9a756
SHA1 hash:
72b3aa3730e4289223d3d7dbb63fa3878ebfe451
Link:
https://www.unpac.me/results/9da2ce3f-7a56-49f8-91ea-db84bd09005d/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/f62cb5e80fdc/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Qakbot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/f62cb5e80fdc9b25cd30ee002a9af4deadf78d6f9bbef6df22cd4a37bc6c1cf9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:unpacked_qbot
Create hunting rule
Description:Detects unpacked or memory-dumped QBot samples
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.
Rule name:win_qakbot_malped
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/317399/

Comments