MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58228a52b83bbd17d6ac52cd52767ebfe01327787b218f9c41ad66c1702bb62b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58228a52b83bbd17d6ac52cd52767ebfe01327787b218f9c41ad66c1702bb62b
SHA3-384 hash: 3b10e8fd0e5e0e301c5a5f5b32f1f50f3aba19c8262b8ea4498c97901f0dcb2f932712400d54a8a8e64fc98b87d139bd
SHA1 hash: d77c5f27e12a5a6f783ea1e3229ad4df13cfb8bf
MD5 hash: 0ebede592a18c2c9a182a6dc36bae30f
humanhash: minnesota-ack-uncle-mississippi
File name:58228a52b83bbd17d6ac52cd52767ebfe01327787b218f9c41ad66c1702bb62b
Download: download sample
Signature QuakBot
Create hunting rule
File size:959'480 bytes
First seen:2020-11-07 17:15:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 26a69d12ffc2f1bc1c4a71f01c654d31 (7 x QuakBot)
ssdeep 6144:o+e6PYNgiQsyaxAUyetu9ITzmXG33wXd5FLY9C3DzkgJkw20y:NPYe4ueQ9ITz8GnwXbFsWDzl+0y
TLSH BB15F001FD78DD06D2A52E7C4E2617B89E8B78C4EC13905376EA4F6CACF63B2985E405
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Razy-9775963-0
Create hunting rule

Win.Trojan.Qbot-9776853-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58228a52b83bbd17d6ac52cd52767ebfe01327787b218f9c41ad66c1702bb62b/
Threat name:
Win32.Trojan.PinkSbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 17:21:03 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lariuuvyho6rpvvmklgve5t6x7qbgj3ypmqy7hcbvvtmc4blwyvq._file
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201108-5qk9sjxqe6/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
58228a52b83bbd17d6ac52cd52767ebfe01327787b218f9c41ad66c1702bb62b
MD5 hash:
0ebede592a18c2c9a182a6dc36bae30f
SHA1 hash:
d77c5f27e12a5a6f783ea1e3229ad4df13cfb8bf
Link:
https://www.unpac.me/results/482ae93a-48f7-4eec-8d3d-5b91499092f3/
SH256 hash:
a29448ae480bc46253bd3c0d9c2467dd041cefd456bb5a7ec8f98c40c73451bc
MD5 hash:
acf407ae776dfb1332ea31bbbcc52bd0
SHA1 hash:
731176cbd6e6845081c9ed4bc039caf6b2e1bb49
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/482ae93a-48f7-4eec-8d3d-5b91499092f3/
Parent samples :
bfb48416b0557ef0d47177d809287384f47d0bf985504ee9b243d7161293364e
e2d5f4c171dc88b453be93a2b940a815143657952863fe6daf32bdd01ed1577d
c537e20b181e0bd13cc919d2decb053e56aad510f0c4011d10454ce8a2339037
93062f1a1c0b4b04c62355d3ee310dcaacb301cd1980ce9ebef89fb3963a40ef
58228a52b83bbd17d6ac52cd52767ebfe01327787b218f9c41ad66c1702bb62b
85753f341c17caad8c49790a7b6beb6ddca9f6106c54ece912203e77baa9aa09
SH256 hash:
06821aa7306481a3ffd04f6fe2af9324135354715a33c02c89255ab11d388980
MD5 hash:
aa0fcc84966e5c46b6f7d5df0546da2f
SHA1 hash:
80093ddf1acad4face3f834d3e5058cc1cc26b01
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/482ae93a-48f7-4eec-8d3d-5b91499092f3/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments