MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2450297d7ef66a5573ab6450aa5578f7e4c293b809f02cdac7126ad55f0e8549. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2450297d7ef66a5573ab6450aa5578f7e4c293b809f02cdac7126ad55f0e8549
SHA3-384 hash: 068592de74cbfc945f455b08223184954f3c20223d8e4f95444262143002de0f1b505f8fe261510afd49743f3ec2e79b
SHA1 hash: 884050f4986f6406d65c117e7a4fe1a9048b10cf
MD5 hash: 8d2214d32e76ec51f9961aba3a92f8d4
humanhash: nebraska-nineteen-alanine-winter
File name:2450297d7ef66a5573ab6450aa5578f7e4c293b809f02cdac7126ad55f0e8549
Download: download sample
Signature QuakBot
Create hunting rule
File size:258'576 bytes
First seen:2020-11-06 10:47:13 UTC
Last seen:2020-11-07 12:52:59 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 303f89b8f429d52fa9a67ddad2dbfa52 (160 x QuakBot)
ssdeep 6144:6dtJ9rtpMBa72/oytPqb+z0qLivK7WzR7mMnk:6d1rMBgkoytF0qLGK70Rc
Threatray 778 similar samples on MalwareBazaar
TLSH CC44E0C1A7EC4145F6FBA27B4577C3103A227C5D682EABBE09F171DC2A38A129E1471D
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.QakBot.11.11733.4101.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/522640
Signature
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to detect virtual machines (IN, VMware)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 310480 Sample: n2qCYQ6s2K Startdate: 06/11/2020 Architecture: WINDOWS Score: 100 31 Multi AV Scanner detection for submitted file 2->31 33 Yara detected Qbot 2->33 35 Machine Learning detection for sample 2->35 37 2 other signatures 2->37 7 n2qCYQ6s2K.exe 4 2->7         started        11 n2qCYQ6s2K.exe 2->11         started        process3 file4 27 C:\Users\user\AppData\Roaming\...\evuny.exe, PE32 7->27 dropped 29 C:\Users\user\...\evuny.exe:Zone.Identifier, ASCII 7->29 dropped 41 Detected unpacking (changes PE section rights) 7->41 43 Detected unpacking (overwrites its own PE header) 7->43 45 Contains functionality to detect virtual machines (IN, VMware) 7->45 47 Contains functionality to compare user and computer (likely to detect sandboxes) 7->47 13 evuny.exe 7->13         started        16 schtasks.exe 1 7->16         started        18 n2qCYQ6s2K.exe 7->18         started        signatures5 process6 signatures7 49 Multi AV Scanner detection for dropped file 13->49 51 Detected unpacking (changes PE section rights) 13->51 53 Detected unpacking (overwrites its own PE header) 13->53 55 6 other signatures 13->55 20 explorer.exe 1 13->20         started        23 evuny.exe 13->23         started        25 conhost.exe 16->25         started        process8 signatures9 39 Contains functionality to compare user and computer (likely to detect sandboxes) 20->39
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2450297d7ef66a5573ab6450aa5578f7e4c293b809f02cdac7126ad55f0e8549/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-10-30 13:01:00 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=erics7l66zvfk45lmrikuvly67smfe5ybhyczwwhcjvnkxyoqveq._file
Verdict:
malicious
Similar samples:
056f95b607706f579516030cac93f0752d3b70622383647b7a7cd3dd595dd8c8
QuakBot
0652d513a2c43aaabbb806eeda3e035aa3b12449a718610d42453896d9f97751
QuakBot
11c6c84f4c67d7ab23c20984648b03289deca9e39dea861b092e0b5fce747b06
QuakBot
21f679e610da831b5793f874a1c1e10c6fcb66a2816b46ecb9081d0672fcbeb6
QuakBot
4a4df13254e5f1e62f8ab02703ebc5d96ecb97ab979f7a8e3a80120935a4df9e
QuakBot
8f3b20670faef6e2e81e2e679af9397ced5ed3116af03585d7f80986451e9987
QuakBot
9adfaa5b63a6a5456740d383e463055f47b796114675f0912e185638ad135d4a
QuakBot
b78c608b6efdbcab010375b990d029eefd2aa139b5796cd5b10adf50a8e48ec3
QuakBot
bcd506c83a908de270fd5fbe9ec541c42a6305a542edd9327ad86657656de4b3
QuakBot
c118e4088bc5aaffebe7208df9f01da9d70ba625ba020c593723495c0954a203
QuakBot
+ 768 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201106-4k6vzcab2x/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
2450297d7ef66a5573ab6450aa5578f7e4c293b809f02cdac7126ad55f0e8549
MD5 hash:
8d2214d32e76ec51f9961aba3a92f8d4
SHA1 hash:
884050f4986f6406d65c117e7a4fe1a9048b10cf
Link:
https://www.unpac.me/results/6e2e80d3-692a-41f3-b869-89e387733ece/
SH256 hash:
64ef4a7cd3fbdcc4144ea8cb5dfd358c91a60c18e1326b6a112f15a03d4b5e38
MD5 hash:
eb7868423d0c4a8787aa137fe93bc672
SHA1 hash:
f507430cdaef337b9605708ef22343dcf2c9e9a5
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/6e2e80d3-692a-41f3-b869-89e387733ece/
SH256 hash:
99ea9ddde1f4179037aaf948b0920f6ae80e1e4c738053ebde9be3283c9430de
MD5 hash:
1401d43f02aa09c746340ef704deb891
SHA1 hash:
f60460fbd3358a8a95b39f03919afa389a796d85
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/6e2e80d3-692a-41f3-b869-89e387733ece/
Parent samples :
2450297d7ef66a5573ab6450aa5578f7e4c293b809f02cdac7126ad55f0e8549
768cce865f75b519643028d50bcbd2927bd64f8b1fe112faaa8a8f4d39408c2d
03f3d80c2d66e09f1ac8196deed5cec1fe1a9f3501ba3fb48ba2d2820b7f97f2
1b8fe9bfaa3f6ab8be12321c2198bb3ca39c6da867dbb503f5a1a3433d099d05
670561effe16712f925e3ef2c2a807020c8d4a227d520016ef03087502f036ad
4691eecceb853d64d7f30e0e901a9df4f385eaca43c5c441dd7100298fbdca71
674c204e1c5d02db45a5d9b434042b17829fadfb5a91a97dee442fd00d56c34c
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments