MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59f5ffbfc917f15266c594807117b13b1f35f6c8446c63b5c24de303728aed39. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59f5ffbfc917f15266c594807117b13b1f35f6c8446c63b5c24de303728aed39
SHA3-384 hash: 7d460caf524757ed3ac15fca056dfecfa4217cc9e1e913c84441bcc44da1d3422c5d6af1e56220ab89ed8c2f721780ae
SHA1 hash: 4b84b3ea7ab04f80bbb8673845ad32fa88d9e491
MD5 hash: a8da920300e6a9f678f87ec891cf5b74
humanhash: monkey-hawaii-vegan-fifteen
File name:SecuriteInfo.com.Troj.Qbot-FS.32549.26453
Download: download sample
Signature Quakbot
Create hunting rule
File size:686'592 bytes
First seen:2020-05-22 19:43:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e07b5ef6a62c63ae5e308f0f9580afdd (1 x Quakbot)
ssdeep 6144:8i8I6NWua+981ga1GmWtLDba7SfL+okPz5ETxX:3/4VaYaoe7STA
Threatray 430 similar samples on MalwareBazaar
TLSH 10E4F057E4AF9F6BFDC3727591AEF8724612DE8DC22BE4231911B068F0A51D3093AB41
Reporter SecuriteInfoCom
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Troj.Qbot-FS.32549.26453.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Qbot
Create hunting rule
Status:
Malicious
First seen:
2020-05-22 20:35:21 UTC
File Type:
PE (Exe)
Extracted files:
2
AV detection:
27 of 31 (87.10%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0c63faba52a07b325662821bd818f9a2f86e927ee9563c86ee832cb133d431b6
Quakbot
11105b9bfa8c28853cbd8e79e1adde11ba44f28b6503c23b5dc0e9c557d34676
Quakbot
2cfcbec026bb16339c4e07f1248afa994338320e78478d4ed75291d570f39509
Quakbot
473e36272f2ee075898de211b5697144b6f5b96ae87b7944ec06f017e18a0566
Quakbot
586dde5090c799890db387f0492dc66623e3d94b7419cda4d4806888939c8232
Quakbot
86a94303dbc0f8c9043bde592e3f5bdd0ecb42ebdf43ca90bb4646d4c597cb57
Quakbot
9227048434aa9c943cce1d581e833a8c514f4e912722df425526673319de7317
Quakbot
b6942601eb28b9a6c168f162eab73bbe9c61d77a2228da5805fd54946ec4ab81
Quakbot
dc6398e3245b49edaa707271cee7eb7b5ad0d1baf45dc82746e7b8dac1e4f5d7
Quakbot
de0070a647ec8c488b2b8be762a377f5130521eb23083b96d4cb6ea94fa11992
Quakbot
+ 420 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201109-d4283jj94n/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments