MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 53df5bb98b96c6a2be5ff6236ab930d8ae6e7ecff953adec7e93c3978c9a81d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | 53df5bb98b96c6a2be5ff6236ab930d8ae6e7ecff953adec7e93c3978c9a81d7 |
|---|---|
| SHA3-384 hash: | 1cbe8a116c0ec107ace5da1f4721c920e0a9ca266a828eff0444d2b39b102c2e270a4cbb63189c01874f38ff0b9a0c94 |
| SHA1 hash: | 91bdbb0dd6d811d0fdb36c664411feda5e282137 |
| MD5 hash: | bc8dd25bce1344119cbe6797088e0c5d |
| humanhash: | blossom-avocado-nevada-wolfram |
| File name: | bc8dd25bce1344119cbe6797088e0c5d.dll |
| Download: | download sample |
| File size: | 261'592 bytes |
| First seen: | 2020-11-25 17:24:02 UTC |
| Last seen: | Never |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | fcb7e66723aeaab780b1c2b44639282c (1 x Quakbot) |
| ssdeep | 3072:G3BNzcIx2gLs5VVnvQYyLTUQHPH3MkKiXy4o+4z774L4yFpeQjLrmzht3WaM0X:GfXgB9yLTUQvH3nKiXtozvYpewrkRMI |
| Threatray | 1'330 similar samples on MalwareBazaar |
| TLSH | 6E44AF79BA12DC12E6682BB062C36FD81E879AD93510510F59F15F9CBEEA3847C13BC4 |
| Reporter |  abuse_ch |
| Tags: | dll |
Intelligence
File Origin
# of uploads :
1
# of downloads :
59
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the Windows subdirectories
Launching a process
Modifying an executable file
Creating a process with a hidden window
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Threat name:
Win32.Trojan.QBot
Status:
Malicious
First seen:
2020-11-25 17:27:18 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
5/5
Verdict:
malicious
Similar samples:
+ 1'320 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Suspicious use of AdjustPrivilegeToken
Program crash
Loads dropped DLL
Unpacked files
SH256 hash:
53df5bb98b96c6a2be5ff6236ab930d8ae6e7ecff953adec7e93c3978c9a81d7
MD5 hash:
bc8dd25bce1344119cbe6797088e0c5d
SHA1 hash:
91bdbb0dd6d811d0fdb36c664411feda5e282137
SH256 hash:
2f90d572b1d449a524086d7f667183d3f65652ac255890e0e6b6a45b5462ae71
MD5 hash:
917f657d8a3dc25dc5b8219511624fbb
SHA1 hash:
32363973a8d01bfcf8d844ef37ca350d4d3b206c
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
dll 53df5bb98b96c6a2be5ff6236ab930d8ae6e7ecff953adec7e93c3978c9a81d7
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.