MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51b5e9d696759eecb2136036a4158667ab7fe0e00505e8669826b7e45e8d3a56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51b5e9d696759eecb2136036a4158667ab7fe0e00505e8669826b7e45e8d3a56
SHA3-384 hash: b592a870012210184803f55e2d7556f49a9c088aa5da9da44791051ba3d2b2ccec46a33c33d9133d9975f127637f15fa
SHA1 hash: dfedc2615ca6ad161f0f10ce63781b5e499b2e42
MD5 hash: 5f6b2505dfb9caa719f0e3b2849b896d
humanhash: florida-oregon-harry-gee
File name:51b5e9d696759eecb2136036a4158667ab7fe0e00505e8669826b7e45e8d3a56
Download: download sample
Signature QuakBot
Create hunting rule
File size:277'456 bytes
First seen:2020-11-09 21:42:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 015974618e9105226f001019d35e62e5 (1'506 x Quakbot)
ssdeep 6144:GLfhdM/bXZswyIZkEuHrBuYFCAN8XkwDLPnC:MvKbXWENyuejgdC
Threatray 853 similar samples on MalwareBazaar
TLSH 6A44F12369799033E4220BB64DB5D3B14D7978646A3208CF2FD803590A2E5F6DB367DB
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.4246.UNOFFICIAL
Create hunting rule

Win.Packed.Lupus-9787366-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Sending a UDP request
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51b5e9d696759eecb2136036a4158667ab7fe0e00505e8669826b7e45e8d3a56/
Threat name:
Win32.Trojan.PinkSbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 00:50:52 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=kg26tvuwowpozmqtma3kifmgm6vx7yhaauc6qzuye236ixunhjla._file
Verdict:
malicious
Similar samples:
12a59869c0e78eed60e76adc9c592ba8b9f3d2835f19d4c46e7a458739d6aedf
QuakBot
5401646f0c0e59d051a7af22287139db248b5b95087c228a9e7380fcd6cedb75
QuakBot
6a25eecf4c09687ee9eb25089d656e75b86b83464b681f08d14d7cd9fa468a6d
QuakBot
6fd76e263b60bd0fb8f99a2d8024e6a03a93004bb133056b1ea5b4dcc58c8441
QuakBot
884497f7a97b26e8436cdb4895e4f67ee461f6114d72c813aa7a8ee21eb15696
QuakBot
a0af507be27c7d6625d6edfaff918b6dec70457e48235dcf141e65a52d37cdf5
QuakBot
a1093cae5947b010c760dc1e04d9ac932b45dfe46f67b38b8f5b37c807084261
QuakBot
a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3
QuakBot
b67267d494ea23d58a61c127eb8e32b274878c3dcfa6586e344604397f7a457b
QuakBot
f2bad33dc7a242f8f6caef8130f6424fcb934a458370f156dd1094b99318cec9
QuakBot
+ 843 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201109-cjfq5rw6gs/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/51b5e9d696759eecb2136036a4158667ab7fe0e00505e8669826b7e45e8d3a56

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments