MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48aec793d8782c9579fd4364683342c3b6ecfe8b87206c219aa5eb8ef62953dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48aec793d8782c9579fd4364683342c3b6ecfe8b87206c219aa5eb8ef62953dc
SHA3-384 hash: 6b83d83665393802aa5d0bedd89479d9f9edf8f426eeeddb13cb3457c962e0228ffc5a106648abdce9be9bcc531df09e
SHA1 hash: 3ea1cae8249ebafee0f562ab8a655557dc606aeb
MD5 hash: e0b95d1de229c86a56c475c21ca1cbf4
humanhash: papa-lima-sierra-artist
File name:48aec793d8782c9579fd4364683342c3b6ecfe8b87206c219aa5eb8ef62953dc
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'424'360 bytes
First seen:2020-11-09 21:09:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4b5837b6418a28d2cc27085fa11f0a6a (45 x QuakBot)
ssdeep 12288:lQNNKBT9g4ObzoL74hxWi1ZJUnoRsG3+etdu:l5BGbzGExWi1QnoRV3+etdu
Threatray 853 similar samples on MalwareBazaar
TLSH 3B652387B779C882C6D905788E5737DC7B4677988F81C04A59E4A92CECF22466ED380F
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Generickdz-9781418-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48aec793d8782c9579fd4364683342c3b6ecfe8b87206c219aa5eb8ef62953dc/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 00:29:25 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=jcxmpe6ypawjk6p5insgqm2cyo3oz7ulq4qgyim2uxvy55rjkpoa._file
Verdict:
malicious
Similar samples:
0d0d997a7c42c11b60cb1e265b015f2559719f640c2adf1c1bf8b85a434a0d0d
QuakBot
2a9ab4b103557c2e45afb9b59ae9243866209cf755fc3435f717439df0871488
QuakBot
45493d88dd9d1670f48aee096d0ca99110337ffbd4d538dd39b2ef3a13cafa63
QuakBot
5e2d7b990c9f6667311a44f7fce078a5bd3e033965db4a31c177bb84b06e8540
QuakBot
76dfd774e997c6f57436d26f9687330780fb4e531be2ac87b987f59caf9420c3
QuakBot
78749911faeac0032bb0c8562761fa6ee3fb85f37e099f5169d9dcc29c8024bd
QuakBot
aab0cda9f1d257a3affd8ee4c8b7eb06369d598afa2a1daa3f0780851fc083cc
QuakBot
b6f7e85a30ca3c72b6d51bee408726e6f0e7b432a6db680b9b271d674e2ece72
QuakBot
ca969bc3c98f90de5ea8bc25056b2267648098a33586bcca79ae432509d95c43
QuakBot
e187fbf6543d1993f0945c04ee520600b6493236bae169a020f9a10c547e249d
QuakBot
+ 843 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201109-frhxxbc2ce/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments