MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1507546bc27652090971bbe5c661030092c57d966d0bb38fc8444f96c669fe2c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1507546bc27652090971bbe5c661030092c57d966d0bb38fc8444f96c669fe2c
SHA3-384 hash: dc0bf1cdb454f9d575bf5231b86d5815eb96985fb6d8c7389d1306792cd9d560b77346d4a8f2f7ed9d1f2e5069d84d30
SHA1 hash: 29824678f9b02c7fabfc06fda7809cd87331e433
MD5 hash: c5c22867d434a8a8b57356c04d8dc78d
humanhash: seven-mango-undress-cola
File name:44363.57011875.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:1'211'392 bytes
First seen:2021-06-16 16:49:47 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 9ad8fb29ab5ef670bcc1e861d3d4e6e4 (1 x Quakbot)
ssdeep 12288:SCP8r0VppTDIPZ3yFjNi8GOwFgzM50SyW/XGNsXtNQ0NAb0cRm4cw5aGwYocvSMP:SCPoPVyFjU8VwFGkIb0ck4cwM9/kSMv
Threatray 1'505 similar samples on MalwareBazaar
TLSH 2D454A00B651A024F9B606F54FAEE1985B3C7DD11B2490DF72D06EEF5E29AE3AC30716
Reporter nokae8
Tags:dll obama60 Qakbot qbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
627
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Sending a UDP request
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Launching a process
Unauthorized injection to a system process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6c9f875a-369c-4482-9420-bbb294593398
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1507546bc27652090971bbe5c661030092c57d966d0bb38fc8444f96c669fe2c/
Threat name:
Win32.Trojan.BankerX
Create hunting rule
Status:
Malicious
First seen:
2021-06-16 16:50:23 UTC
AV detection:
3 of 46 (6.52%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cudvi26cozjasclrxps4myidacjmk7mwnuf3hd6iirhznrtj7ywa._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
154bb70ce4102c04094ec6076d61fcdbb53bdb01e8e401fbeeab42e667cc7778
Quakbot
224c62bcaf9e4eb208ea49c9727edc7cadfbd58c6209595a66a636627f43d085
Quakbot
3b4d7f8036918c75267ca13980ac17419652c12d968336013808b04151b47455
Quakbot
3c40784862d5a82b93baaa62432b2903048c5fcfaa9d3d31cebb96ae4980ddd4
Quakbot
71bb9ec22752238b773f5103e0089f85488eacb73f1b7fb3a3625ae9dc606c3a
Quakbot
75bd9e581d48f304bec7cf8f07fc56937501e67a578d33252915b455fc2506f1
Quakbot
80cfabe6a394c7737a22d5ea72c604fb65fb6b66e979e848d07507343fbdb705
Quakbot
a94291cc6f39425c30d1152a83ae122c0c8f10c8bf2f77c94542bbb30203aa94
Quakbot
b93a9e972d297bb2a0ae163d5c9a087bf29dc5db48eaab8d9e0e5560f48065c0
Quakbot
cdb955547f9718c2755a828c8b3d5a4baa2e97f31ba77fadef01e78abb8f3b68
Quakbot
+ 1'495 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/210616-zbe9n1phxe/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Qakbot/Qbot
Unpacked files
SH256 hash:
6d41439ac9309eca50588dc1abadef26839cac9bbcb52c9d4ff55fac29b86b1e
MD5 hash:
259541642015dd01d40829aa708931d6
SHA1 hash:
7042d70b62cc3020c2a2f049d1f42a2857a30ee9
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/cdd0a799-04c9-48a1-b286-bbe7e45639d7/
SH256 hash:
1507546bc27652090971bbe5c661030092c57d966d0bb38fc8444f96c669fe2c
MD5 hash:
c5c22867d434a8a8b57356c04d8dc78d
SHA1 hash:
29824678f9b02c7fabfc06fda7809cd87331e433
Link:
https://www.unpac.me/results/cdd0a799-04c9-48a1-b286-bbe7e45639d7/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1507546bc27652090971bbe5c661030092c57d966d0bb38fc8444f96c669fe2c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
URLhaus
https://urlhaus.abuse.ch/browse/tag/obama60/

Comments