MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b8fe9bfaa3f6ab8be12321c2198bb3ca39c6da867dbb503f5a1a3433d099d05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1b8fe9bfaa3f6ab8be12321c2198bb3ca39c6da867dbb503f5a1a3433d099d05
SHA3-384 hash: b50ff4ffa6dacfef8af29f509c8c00da7348c7cd1890059b665e538a46f8f9140c85b9cead0593fca5c8b24572331c30
SHA1 hash: 8ee37eb1fd9611c97d17f60b9c89ea35781ab168
MD5 hash: d7280aa3546b288494e844138f470f08
humanhash: maryland-romeo-virginia-blue
File name:1b8fe9bfaa3f6ab8be12321c2198bb3ca39c6da867dbb503f5a1a3433d099d05
Download: download sample
Signature QuakBot
Create hunting rule
File size:258'576 bytes
First seen:2020-11-12 14:09:46 UTC
Last seen:2024-07-24 11:51:04 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 303f89b8f429d52fa9a67ddad2dbfa52 (160 x QuakBot)
ssdeep 6144:6dtJ9rtpMBa72/oytPqb+z0qLivK7WzR7mMQ7:6d1rMBgkoytF0qLGK70Ry
Threatray 1'249 similar samples on MalwareBazaar
TLSH C044E1C1A7E80184F6EBA2B74477C3103A127C9D693D9B7F1AF5B1EC2931A219D2871D
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.QakBot.11.11733.4101.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1b8fe9bfaa3f6ab8be12321c2198bb3ca39c6da867dbb503f5a1a3433d099d05/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 14:11:56 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=doh6tp5kh5vlrpqsgiocdgf3hsrzy3nim7n3ka7vugrugpijtucq._file
Verdict:
malicious
Similar samples:
03f3d80c2d66e09f1ac8196deed5cec1fe1a9f3501ba3fb48ba2d2820b7f97f2
QuakBot
0b759c4168882c3fdf101507c2a5cb246244f792eb478b5a5195433a0a8eae69
QuakBot
46c407bc6a89726389f73de450a801d6d14a9fb97447f2fd449514cbcf33baad
QuakBot
5c4243b2a27c731bdbf29375d308252fbf0e071b6ea0bed813b61cfe6926e738
QuakBot
73efa825c8ac05d163d714fa32c9761a7850b3955207690ebacf661cdfb15f9f
QuakBot
7acf54afb2da619579c75936b67be5d13997bce00fca3959696e3956bcf628fb
QuakBot
7b023a29e60cf740c590492d57cc36df3c1554e0a7a8e30e3669cdc4499001b5
QuakBot
9f90bdf9ba391e45d111d84c6f59f074410928c306feef877ee9e1a2e0668f16
QuakBot
d9b5e7443c3d48d18c5da2ce0dbd958cdc6eac082bede6ba35a8531a5a39470e
QuakBot
e55c191f081d06d46846f73db4d847c3a08da2a517b70ee119f2586c308ebd1d
QuakBot
+ 1'239 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201112-strkpxaexa/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
1b8fe9bfaa3f6ab8be12321c2198bb3ca39c6da867dbb503f5a1a3433d099d05
MD5 hash:
d7280aa3546b288494e844138f470f08
SHA1 hash:
8ee37eb1fd9611c97d17f60b9c89ea35781ab168
Link:
https://www.unpac.me/results/7e734a2f-b57b-4427-b346-534d49df2557/
SH256 hash:
5c27a462b55cb5e6d808868a7a8e4c330cd5fffe80df2e96f7118f9da6f08e22
MD5 hash:
f19f69fa6131f8ed684bfe05ac97dc35
SHA1 hash:
6157596e2305ac990a3f9a44a7560deba7bd1ae0
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/7e734a2f-b57b-4427-b346-534d49df2557/
SH256 hash:
99ea9ddde1f4179037aaf948b0920f6ae80e1e4c738053ebde9be3283c9430de
MD5 hash:
1401d43f02aa09c746340ef704deb891
SHA1 hash:
f60460fbd3358a8a95b39f03919afa389a796d85
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/7e734a2f-b57b-4427-b346-534d49df2557/
Parent samples :
2450297d7ef66a5573ab6450aa5578f7e4c293b809f02cdac7126ad55f0e8549
768cce865f75b519643028d50bcbd2927bd64f8b1fe112faaa8a8f4d39408c2d
03f3d80c2d66e09f1ac8196deed5cec1fe1a9f3501ba3fb48ba2d2820b7f97f2
1b8fe9bfaa3f6ab8be12321c2198bb3ca39c6da867dbb503f5a1a3433d099d05
670561effe16712f925e3ef2c2a807020c8d4a227d520016ef03087502f036ad
4691eecceb853d64d7f30e0e901a9df4f385eaca43c5c441dd7100298fbdca71
674c204e1c5d02db45a5d9b434042b17829fadfb5a91a97dee442fd00d56c34c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1b8fe9bfaa3f6ab8be12321c2198bb3ca39c6da867dbb503f5a1a3433d099d05

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments