MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f96c9e5d5e5d81fc0a82e679b7eba5773200dd36e62f33fb56f0be903999412a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	f96c9e5d5e5d81fc0a82e679b7eba5773200dd36e62f33fb56f0be903999412a
SHA3-384 hash:	41bcddb912b04c6e09c8a366f8bad4c1cd243018b012dc4c2ced83d7736297c1e122bfcaa862c0cd083f6ceabe68907b
SHA1 hash:	9a4ab156834e72f4bdf86d9744ad5ff4d2633aa7
MD5 hash:	48ad92bff43aecc1c225a64713528197
humanhash:	cola-network-table-fifteen
File name:	f96c9e5d5e5d81fc0a82e679b7eba5773200dd36e62f33fb56f0be903999412a
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	842'366 bytes
First seen:	2022-04-14 12:18:46 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	a8e1fac8e86bd2f55e226e173348d421 (13 x Quakbot)
ssdeep	12288:QT7VyvDn5CX/JYLL+wLg+aCsnnzxS/WZ6xyK4zxfDoN+wLvp96GvZvc/ZscK6Frs:QPMb8vO3xsNxFm4zxILRtxvc/ZdK6FI
Threatray	464 similar samples on MalwareBazaar
TLSH	T101059FB8794818F4D7DBD63649ADB8B913B332635AC75C89015DB3C20A7F362AFC1A05
TrID	32.2% (.EXE) Win64 Executable (generic) (10523/12/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4505/5/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter	JAMESWT_WT
Tags:	dll Quakbot VALENTE SP Z O O

Intelligence

File Origin

# of uploads :

# of downloads :

227

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/263733/

Detection(s):

Win.Keylogger.Qbot-9942604-0

Win.Packed.Qbot-9943968-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

Launching a process

Searching for synchronization primitives

Creating a window

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

greyware overlay

Link:

https://www.filescan.io/uploads/62581156482f2f41caadecb6/reports/43926cf7-aebf-42bf-bfef-33029712e997/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/510d06e2-2ba4-4182-9e65-1c2bb5929a19

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f96c9e5d5e5d81fc0a82e679b7eba5773200dd36e62f33fb56f0be903999412a/

Threat name:

Win32.Backdoor.Quakbot

Status:

Malicious

First seen:

2022-04-13 23:43:34 UTC

File Type:

PE (Dll)

Extracted files:

AV detection:

31 of 41 (75.61%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=7fwj4xk6lwa7ycuc4z43p25fo4zabxjw4yxth62w6c7jaomzieva._file

Verdict:

malicious

Label(s):

qakbot

Result

Malware family:

qakbot

Score:

10/10

Tags:

family:qakbot botnet:aa campaign:1648110482 banker stealer trojan

Link:

https://tria.ge/reports/220414-pg6dmabdc9/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of WriteProcessMemory

Qakbot/Qbot

Malware Config

C2 Extraction:

90.120.65.153:2078
179.100.109.11:32101
24.43.99.75:443
37.186.54.166:995
47.23.89.62:993
72.76.94.99:443
117.248.109.38:21
75.99.168.194:61201
31.215.69.127:443
45.9.20.200:443
203.122.46.130:443
173.174.216.62:443
144.202.2.175:995
149.28.238.199:443
140.82.63.183:443
45.63.1.12:443
140.82.63.183:995
144.202.3.39:995
45.63.1.12:995
45.76.167.26:995
45.76.167.26:443
149.28.238.199:995
144.202.3.39:443
144.202.2.175:443
190.206.211.182:443
86.195.158.178:2222
47.23.89.62:995
70.57.207.83:443
207.170.238.231:443
217.165.85.224:993
1.161.80.99:443
39.44.127.250:995
32.221.225.247:995
5.95.58.211:2087
180.233.150.134:995
45.241.207.212:995
188.55.248.211:995
71.13.93.154:2222
39.33.182.192:995
197.2.149.15:443
121.74.182.236:995
91.177.173.10:995
83.110.85.209:995
41.230.62.211:993
70.46.220.114:443
81.60.216.223:995
172.115.177.204:2222
103.88.226.82:443
80.11.74.81:2222
114.79.148.170:443
89.101.97.139:443
172.114.160.81:995
67.209.195.198:443
75.159.9.236:443
201.172.31.135:2222
24.178.196.158:2222
41.228.22.180:443
182.191.92.203:995
37.152.80.105:443
93.48.80.198:995
92.96.183.242:2222
24.152.219.253:995
113.11.89.170:995
195.32.57.18:80
197.161.137.196:993
39.57.112.37:995
105.186.127.127:995
78.87.196.125:995
217.128.122.65:2222
120.150.218.241:995
79.52.204.9:50001
41.215.152.154:995
2.42.176.91:443
86.98.208.214:2222
190.73.3.148:2222
76.70.9.169:2222
119.158.97.217:995
74.15.2.252:2222
209.180.70.25:443
75.99.168.194:443
118.174.95.247:443
76.69.155.202:2222
78.188.76.167:443
189.146.51.56:443
108.60.213.141:443
177.97.48.132:443
176.67.56.94:443
208.107.221.224:443
148.64.96.100:443
47.180.172.159:443
140.82.49.12:443
92.96.183.242:1194
92.177.45.46:2078
96.21.251.127:2222
161.142.56.8:443
39.49.35.170:995
1.161.80.99:995
175.145.235.37:443
83.110.85.209:443
31.35.28.29:443
202.134.152.2:2222
86.98.27.253:443
5.32.41.45:443
75.188.35.168:443
103.230.180.98:443
76.25.142.196:443
173.21.10.71:2222
189.237.6.251:443
76.169.147.192:32103
71.74.12.34:443
67.165.206.193:993
47.158.25.67:443
73.151.236.31:443
174.69.215.101:443
82.41.63.217:443
45.46.53.140:2222
201.145.226.223:443
201.170.181.247:443
191.99.191.28:443
47.180.172.159:50010
69.159.200.138:2222
201.103.6.221:443
47.156.191.217:443
72.252.201.34:990
63.143.92.99:995
72.12.115.90:22
108.4.67.252:443
189.248.86.71:443
40.134.246.185:995
70.51.135.39:2222
100.1.108.246:443
24.229.150.54:995
24.55.67.176:443
72.252.201.34:995
105.225.175.168:995
179.158.105.44:443
179.178.78.112:443
200.100.246.85:32101
109.12.111.14:443
2.34.12.8:443
143.0.34.185:443
81.132.186.248:2078
82.152.39.39:443
201.172.231.204:443
186.106.197.52:443
187.211.77.68:443
196.203.37.215:80
111.125.245.118:995
176.88.238.122:995
120.61.1.91:443

Unpacked files

SH256 hash:

f96c9e5d5e5d81fc0a82e679b7eba5773200dd36e62f33fb56f0be903999412a

MD5 hash:

48ad92bff43aecc1c225a64713528197

SHA1 hash:

9a4ab156834e72f4bdf86d9744ad5ff4d2633aa7

Link:

https://www.unpac.me/results/5c2da394-4f7d-4028-a222-c11d00ec1dea/

Malware family:

QBot

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/f96c9e5d5e5d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.88

Link:

https://yomi.yoroi.company/submissions/f96c9e5d5e5d81fc0a82e679b7eba5773200dd36e62f33fb56f0be903999412a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	QakBot Create hunting rule
Author:	kevoreilly
Description:	QakBot Payload

Rule name:	win_qakbot_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

DLL dll f96c9e5d5e5d81fc0a82e679b7eba5773200dd36e62f33fb56f0be903999412a

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/2115211/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/263733/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample