MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 2ba5b16b9ce46066c1122bad1fc5feb3de0743451c6603b98e3d0ffe6f9cc019. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | 2ba5b16b9ce46066c1122bad1fc5feb3de0743451c6603b98e3d0ffe6f9cc019 |
|---|---|
| SHA3-384 hash: | 1dcdcb5f5623f9349a3c9077c35e6d940d4b6784fa0ab69ef01a0cd7e3a85d911766a03d6574f7a79d45e6858738fe7f |
| SHA1 hash: | 39bded7be089db516305509c86e1ffb98a0d7c0e |
| MD5 hash: | f9e97087a410da7db6a216fd8a2e535e |
| humanhash: | colorado-seven-carbon-item |
| File name: | SecuriteInfo.com.BScope.Trojan.Encoder.14347 |
| Download: | download sample |
| File size: | 176'008 bytes |
| First seen: | 2020-06-04 13:31:28 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | db6b82fd0431d6d6dc7ebbbcb741a8f1 |
| ssdeep | 1536:VLxSI1T+faw3Wtr5pOsgTqGWtREPBqeiu:B4dywKr5pzEqZRSBqO |
| Threatray | 152 similar samples on MalwareBazaar |
| TLSH | 8904AEC56EAC00C3F9F78B7515E10C7BA5F4B8427776C8453DC96B4A2B96F824724B22 |
| Reporter |  SecuriteInfoCom |
Intelligence
File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Threat name:
Win32.Backdoor.Quakbot
Status:
Malicious
First seen:
2020-06-04 11:55:26 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 142 additional samples on MalwareBazaar
Result
Malware family:
smokeloader
Score:
10/10
Tags:
family:smokeloader backdoor cryptone packer trojan
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of UnmapMainImage
Deletes itself
Loads dropped DLL
Executes dropped EXE
CryptOne packer
SmokeLoader
Malware Config
C2 Extraction:
http://transvil2.xyz/index.php
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
exe 2ba5b16b9ce46066c1122bad1fc5feb3de0743451c6603b98e3d0ffe6f9cc019
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.