MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2372c12bf9bb289210f9be4cde76110e2848dd34d3c345df8991698b5f024741. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2372c12bf9bb289210f9be4cde76110e2848dd34d3c345df8991698b5f024741
SHA3-384 hash: 28f49cc62683f779318282276af44c977febe4ee537effa724ba0a12d2702090775169a7b269998991177c3ec89a1820
SHA1 hash: 205a81faccd3e11f3d25aa566b6bdada5aaf4636
MD5 hash: 95c1d567b7f8b7b7a372c95d60f709ff
humanhash: fifteen-paris-alaska-october
File name:2372c12bf9bb289210f9be4cde76110e2848dd34d3c345df8991698b5f024741
Download: download sample
Signature QuakBot
Create hunting rule
File size:271'872 bytes
First seen:2020-11-15 22:38:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 015974618e9105226f001019d35e62e5 (1'506 x Quakbot)
ssdeep 6144:DLfhdM/bXZswyIyO6t0nh7lqoDKOAP4Pshao8:nvKbXWNmVHelmEao8
Threatray 1'465 similar samples on MalwareBazaar
TLSH EC44F21324759436F82607F68DA6C2B10D6E7868AE3145CF2FC85308472E9F28B777DA
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Lupus-9787367-0
Create hunting rule

Win.Packed.Qbot-9791227-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2372c12bf9bb289210f9be4cde76110e2848dd34d3c345df8991698b5f024741/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-15 22:40:23 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=enzmck7zxmujeehzxzgn45qrbyuerxju2pbulx4jsfuywxyci5aq._file
Verdict:
malicious
Similar samples:
043871c2477ca65a53ff58599afd7f0baf33e28fcbcbaeadb52927d05c7e545a
QuakBot
6f0a2c9e8423977aaa763982235616f4ed39099ee179aa64758b048937de2186
QuakBot
7bee1221cbd108696ffa02049448bf4a39894b742f6cba59bd67bc83863617b3
QuakBot
7fb454585abbfd65e04b73a21e3ad5fbdc74223d69d365d9d6d984d76729fbb7
QuakBot
9eedf07e717b4dc90fa3499e26fd866f9475577b93395a7e26212fef34b2bc38
QuakBot
b5bff555af4e917b3eae2fcfb132be09f9f8c96388d1631c1df8fa456f127627
QuakBot
c63e971fa345aed7554581f94332399d11306ef1b7d6b8e297cb49b017c5257a
QuakBot
e961f0028bfaffdb2fa4c7360fb09539f06fddd5f1e988651615fcbe7dbd9e66
QuakBot
f60db8b9c4bae76c8ddefce5b1c7be20c898d6da819db3e1a748b22a2813ff5b
QuakBot
f790ce816ad4c5986967bb15262e5f5ff2f1e0ca69ad172c4dab25d36cc61f4a
QuakBot
+ 1'455 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201115-191m5nljjj/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
2372c12bf9bb289210f9be4cde76110e2848dd34d3c345df8991698b5f024741
MD5 hash:
95c1d567b7f8b7b7a372c95d60f709ff
SHA1 hash:
205a81faccd3e11f3d25aa566b6bdada5aaf4636
Link:
https://www.unpac.me/results/f9c9cd57-1b69-4a00-8e9c-038bf5975432/
SH256 hash:
84025d49dd7ede6021f65836416cc900f98b0feb0bb55033c124f0b199e2129f
MD5 hash:
a5a82edd65324f5488261a8d609bb621
SHA1 hash:
770d4d60d53f08aee20e8aed3bbad699392293c5
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/f9c9cd57-1b69-4a00-8e9c-038bf5975432/
SH256 hash:
a704748cdceb5e5f96cd6e131ac644f90a4afe03db1c793970a2336c4a5dea77
MD5 hash:
1724a458d86ec5b7aeda2b0e96176d66
SHA1 hash:
ef53ef5f37d66a0789677dc690d3fdc5d19103e6
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/f9c9cd57-1b69-4a00-8e9c-038bf5975432/
Parent samples :
6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c
d9ea9dc5a145e58531ea7b29cd4e38bbc8c36011590f3fada67f54829d6bd118
8f29ad62267629b927d763f557e10e3d4ed3b77c118c02bb143e51d4b4063d2b
38966308974a1973a0ff01395612965813e52cd3c4929e11b32027a5dd461dd9
5a6d7886458e2bf4e05af49a375c0df110893c72568a7f9fd804bbf889e81535
8df12f8055512ff01c690e1b45777fab03eddaf60845afbfadaa3b3d225e3aec
8460eff35d8d6196b16f1b67cfd1557176138962ce63c1eeb0553a700c84c923
789d5cbf2f1d5cf98ab6c8ed84f472786559f6f1dc8cabc5ddbd48b6f25cfe39
bd35fbaa9b56c8bada6f731b09b9db2297eced473bbbc96d355fe24b43ddd248
c135fe92da22d209e22fc7c9ad83d2456f9f783874b1c9ed9be87fed650510e0
2372c12bf9bb289210f9be4cde76110e2848dd34d3c345df8991698b5f024741
0bda4b37e2a0a89a0272b0a5bc87cc25de33ba4ebf4e4c4b35f5094a455c01c9
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2372c12bf9bb289210f9be4cde76110e2848dd34d3c345df8991698b5f024741

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments