MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 395ae55fcb6b064f50bb352630c3040ac7cc1fe8e2b6df51116f173c3c37eb8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 395ae55fcb6b064f50bb352630c3040ac7cc1fe8e2b6df51116f173c3c37eb8a
SHA3-384 hash: fb3d7e71ba800985b30ba3e5b1fb2609b7e891ad9f3e3c695afe3f2dac6cb368260b00889741ec049b541842337df2a9
SHA1 hash: 7a4541ef93c7b0d74f9b3d69d4f3250bb576db60
MD5 hash: b9ecb022b0eee5185f919d2751a5921d
humanhash: december-angel-chicken-enemy
File name:395ae55fcb6b064f50bb352630c3040ac7cc1fe8e2b6df51116f173c3c37eb8a
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'218'048 bytes
First seen:2020-11-06 00:50:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash cca8d3f490bf0e00feae0568e0bcc049 (144 x Quakbot)
ssdeep 6144:kywb1UklZzmm+a0rkG6LgwLUIW2KXPqD8Qz+Xu+iPQeARoLwl:yetmdvDk2UXPSj+XuJsPl
Threatray 761 similar samples on MalwareBazaar
TLSH 5C45F142F2FCC4E6E5F919784667532C64189DA89B21C05B73AC6F6CBCF22117CB620B
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
48
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Exre-9781425-0
Create hunting rule

Win.Malware.Qbot-9783629-0
Create hunting rule

SecuriteInfo.com.Trojan.QakBot.11.11330.15397.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/395ae55fcb6b064f50bb352630c3040ac7cc1fe8e2b6df51116f173c3c37eb8a/
Threat name:
Win32.Trojan.QBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-30 10:12:40 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hfnokx6lnmde6uf3gutdbqyebld4yh7i4k3n6uirn4ltypbx5ofa._file
Verdict:
malicious
Similar samples:
100805c582954d2c13b233229c9f7fe3f4b911ef16dad7aaec5b4616405f7d38
QuakBot
45bd22771aeaab651a6ff5a3a23193446ffd305472082d06ad6612878fa2786e
QuakBot
8f3b20670faef6e2e81e2e679af9397ced5ed3116af03585d7f80986451e9987
QuakBot
91020b6ada47f05e9941da3d5fc747a4bdf088e30fdbf010b50ce9ccf0de0cc6
QuakBot
92459aab5fc4c348f5a6a10fa7ce8bc734121a8e2d8d3c30e4337f74ae87017a
QuakBot
a7af3791a39b09053d1760dbddfbfa08a63e39349893215ac572efe60f63f6fb
QuakBot
b66b7bfcdc8d6fb55fe600c20302405a22e1e7b60a0bb1e48a0ccf4e5daf8e50
QuakBot
b97710861c37a16498f15085ab4c578b2d6b83a80249530b3a33b1edaeb13618
QuakBot
e53225b0bc4289135057d05fcbd0aaf79e5a25cf842e8dfd7f1dcaf60f154296
QuakBot
e6e67623e24b8c95021d63966ac7f2ba20e7fbe9495b32290871fc9fa8fe4fe3
QuakBot
+ 751 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201108-tahdnz72g6/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/699334/

Comments