MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3de6c6f78ecb3e37e382ef7d33bc353464ad85d524be5a57c86d7cc48f0a2215. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3de6c6f78ecb3e37e382ef7d33bc353464ad85d524be5a57c86d7cc48f0a2215
SHA3-384 hash: 98f28015d99faf7bdaebc566cfadeaafe3bf1180be20cf280af208dc40a2ee14d071d12393a987615c1fc1c2053618b2
SHA1 hash: 5fb569c91ebe534d1993a9e4e8b7be5ef7b18d72
MD5 hash: 720c21bf7a2718971696b9ccba385223
humanhash: oranges-louisiana-autumn-pip
File name:3de6c6f78ecb3e37e382ef7d33bc353464ad85d524be5a57c86d7cc48f0a2215
Download: download sample
Signature QuakBot
Create hunting rule
File size:2'803'712 bytes
First seen:2020-11-07 16:41:17 UTC
Last seen:2020-11-07 16:48:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 89eeabb919f527d63c1706a14081d639 (4 x QuakBot)
ssdeep 12288:RDmJnJHUrcxNxTxfxNxnxNxIWxNxsyRxNxRxNx0xNxr7a5NGLn1t/3:R65cSkamLnT/
TLSH 89D5F1E829E14033E39DCBBE4A2EBC3AC5163A52E427C7C6FE90C596ED0175605DF489
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
3
# of downloads :
50
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Qakbot-9785224-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3de6c6f78ecb3e37e382ef7d33bc353464ad85d524be5a57c86d7cc48f0a2215/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 16:43:12 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=hxtmn54ozm7dpy4c556thpbvgrsk3boves7fuv6inv6mjdykeikq._file
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201108-6dz7e5nk32/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
3de6c6f78ecb3e37e382ef7d33bc353464ad85d524be5a57c86d7cc48f0a2215
MD5 hash:
720c21bf7a2718971696b9ccba385223
SHA1 hash:
5fb569c91ebe534d1993a9e4e8b7be5ef7b18d72
Link:
https://www.unpac.me/results/dcb80f9e-f4cc-4086-8ad6-967259ffb838/
SH256 hash:
b3869c8c61ce01dc2e8ef889c7f9cf5fa0bc92bf529654aae33d07d5fcc18811
MD5 hash:
b118d48f93298898291372087e0e7ba2
SHA1 hash:
81e8a390c05feb80c97b081d133f8f541e7b5b5d
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/dcb80f9e-f4cc-4086-8ad6-967259ffb838/
Parent samples :
fb06ebc9ddde4c52a9264c9097529658d80d280d2cc19fc7ed8c9f6a0bd69bb8
9212d45aa7a2690055046de6c386f71f625989845ec84186a989f642bc443a5d
7ca48480ca645ee2b83bf707893e84115f87ea6e327f369e40c4ab0afc8abe7a
3de6c6f78ecb3e37e382ef7d33bc353464ad85d524be5a57c86d7cc48f0a2215
61b35cee08ec2846505e9b4e3a62781b70746709c5be14487e8a4f135b503294
SH256 hash:
822ba0f40fdcfef04099b872b6fd26f92883af830de35cbb7d89d8e6c5a15c86
MD5 hash:
ab0b5ac10455a4cec913119da3306a7b
SHA1 hash:
da6cc4e9dfbd1bd8c0bda91dae8af87da641457b
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/dcb80f9e-f4cc-4086-8ad6-967259ffb838/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments