MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 473e36272f2ee075898de211b5697144b6f5b96ae87b7944ec06f017e18a0566. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 473e36272f2ee075898de211b5697144b6f5b96ae87b7944ec06f017e18a0566
SHA3-384 hash: 6fc19dc82420dc1ca722b09c97b26ea5d0219101df523c83889749f7631cc3f3de48f72a9a6ec8dabcffd586ce620be1
SHA1 hash: 9bd32c619bd3ee22851618bd0e1550f735ccc8ab
MD5 hash: 493ac7e4778d6fdb89ebdfc13089aee5
humanhash: yankee-california-emma-angel
File name:SecuriteInfo.com.Troj.Qbot-FS.30338.24988
Download: download sample
Signature Quakbot
Create hunting rule
File size:689'152 bytes
First seen:2020-05-25 14:29:12 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e5bc74f731ea8626c5c455b44885e2a9 (11 x Quakbot)
ssdeep 6144:IXFqnMdDCTWua+t2gqIpcSuPtlklAghAWD2PNEt8bjryp9ORALvdL:KCMAVaFgq6LuM+0D2PNEt8bHE0CbdL
Threatray 1'316 similar samples on MalwareBazaar
TLSH 0CE4DE17692F9F6FFFCA723551ACF8B1A516FF4C1327A8323610B0A9B1A129B4535702
Reporter SecuriteInfoCom
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Troj.Qbot-FS.30338.24988.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-05-25 14:36:37 UTC
AV detection:
36 of 48 (75.00%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0758b43a955dc7f5f529c71d6100de1e0d91ffc50979bf9cda950e4d2fe6545a
Quakbot
0ba28e54028cd866c9d7baec0fe4a46bfe37e77f1d5c89114920cf58c540993f
Quakbot
11105b9bfa8c28853cbd8e79e1adde11ba44f28b6503c23b5dc0e9c557d34676
Quakbot
3d8bc67bb77836ec4d9e2ab1e32a825aad31b5367fe2aa82d50fd6175ce3932f
Quakbot
6e8cde7e5df5e1aaf6addee434e442ff86d10ea4c1b65548a5e8544d0023019f
Quakbot
8a827ae438d49f48d3a737f838b29aa5ba62d3642d85f8c9a3ebd0b6ccda8ed8
Quakbot
a0af07ff38ec3540dfcd165f09114ec857c86face8231d5d1eeb20c12e019822
Quakbot
b840d427761bd6b69b6dbdfda6d4ac764f6cc0116c6b932b66a47886aca3be77
Quakbot
e2e79a41086f5e3cdb09c6cd64bc7e474d5fa9dd503004924c74c365e85c5efd
Quakbot
face4965333ed1843cb00bbac6e623824373f78f5c10030f5e5c046011556090
Quakbot
+ 1'306 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201109-wvfy82r3x2/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments