MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4da932e297755bee1df38f19b60605892d7eec44606bd20317ba4264ee3664fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4da932e297755bee1df38f19b60605892d7eec44606bd20317ba4264ee3664fb
SHA3-384 hash: 66bbd81aba7c8b8b91227a8e16d188042aea245c9c0cd24ba4e9ca9b7dd4ef4fd812b4152893266f49294d3f409f22d3
SHA1 hash: 7c2c9a0b9422f25182fe50d2132a74a8c5040a90
MD5 hash: 87c333cc98ade79e3dfb21448a35f617
humanhash: india-fillet-carolina-social
File name:4da932e297755bee1df38f19b60605892d7eec44606bd20317ba4264ee3664fb
Download: download sample
Signature QuakBot
Create hunting rule
File size:261'080 bytes
First seen:2020-11-13 15:25:51 UTC
Last seen:2024-07-24 14:05:42 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:1CawmISRvDkMFC2Z0Jy4hoahQ/ii0ueKCfu+XuFKgMLqllq7PCufDfq433wb3/JC:gawCRk4Z0NhbJtWYKjSTfiGZ
Threatray 1'347 similar samples on MalwareBazaar
TLSH 4F44E05263E80444F86B97B78C71835016227CA5AB3E5A9D0EC5B37C4E35FB16BE072E
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
54
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.QakBot.39.31214.3776.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4da932e297755bee1df38f19b60605892d7eec44606bd20317ba4264ee3664fb/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 15:28:42 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jwutfyuxovn64hptr4m3mbqfrewx53cembv5eayxxjbgj3rwmt5q._file
Verdict:
malicious
Similar samples:
26a9b67b001c7839f501a44b99004ea3896bf36e2ee1dc5e67616884a3d4a742
QuakBot
391898d5f70ab4ea476445b7efeee666181e939970cf61a4df1f21e23b265148
QuakBot
5d54daee0244973fcaa6015389c9bb35ef5bfe00b641066be0d29950928a05dd
QuakBot
83ffb5742f448672bb348e6bfe213894405e6ee91e687583c46e1d651a10b5c4
QuakBot
9eb9aed19367ef498c22e06b213d6a94636d362b9b248031dfdfe00791586a14
QuakBot
9f90bdf9ba391e45d111d84c6f59f074410928c306feef877ee9e1a2e0668f16
QuakBot
a78c2c87982e0100377435c95455d4dce74699ab81c1a7f1981631c6d1800382
QuakBot
d9b5e7443c3d48d18c5da2ce0dbd958cdc6eac082bede6ba35a8531a5a39470e
QuakBot
e55c191f081d06d46846f73db4d847c3a08da2a517b70ee119f2586c308ebd1d
QuakBot
e94ee23df573403682a2c8fe38b469aa9cb9fca18349b0fe4eacbc181c096b0e
QuakBot
+ 1'337 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201113-55gx5sp1gx/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
4da932e297755bee1df38f19b60605892d7eec44606bd20317ba4264ee3664fb
MD5 hash:
87c333cc98ade79e3dfb21448a35f617
SHA1 hash:
7c2c9a0b9422f25182fe50d2132a74a8c5040a90
Link:
https://www.unpac.me/results/ab6f14bc-ae1f-4a17-a962-775eadc944f2/
SH256 hash:
1ebbc2241d48c3dcec2062a52cfda4c9a620b009ca741867dd0a526c3691e287
MD5 hash:
d71c2bbe99b203132b4413325cdba26f
SHA1 hash:
1189a31926f88895723f0f2908169b367be766c2
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/ab6f14bc-ae1f-4a17-a962-775eadc944f2/
SH256 hash:
98c584afd893d90ce739898eb1884b55e0563361ae51bdd661f707598b2c74b4
MD5 hash:
1dc0e5190afd9a815cb196524f9004ba
SHA1 hash:
5718a34f9f4a2d31d601256ea54a4642ff93e173
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/ab6f14bc-ae1f-4a17-a962-775eadc944f2/
Parent samples :
e187fbf6543d1993f0945c04ee520600b6493236bae169a020f9a10c547e249d
572a838c619dd3e50821877544f02fd5666c290645352fecf6e92419fb7dc65e
dcda70b5cc63629dd2760dbc76ffda0bedefd0ee92af4d4e3740acc7dd2eaff2
5ddf021d191640fee8678ccdee0bff82ccca8d4fa552bffd78fb83757bc3fdba
4da932e297755bee1df38f19b60605892d7eec44606bd20317ba4264ee3664fb
07800361c385ebe050c51f65392e9fe7aab7e12163241e5ba5ac80e7e82ca438
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4da932e297755bee1df38f19b60605892d7eec44606bd20317ba4264ee3664fb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments