MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a6d7886458e2bf4e05af49a375c0df110893c72568a7f9fd804bbf889e81535. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5a6d7886458e2bf4e05af49a375c0df110893c72568a7f9fd804bbf889e81535
SHA3-384 hash: 43c01d8fa14d5635f299c3cdfe511ee5f8403314f53f1d83de731fc727d43a475ba42ffe9052b2b5d003a27ea31aaca1
SHA1 hash: 09fddcb6cfebd5ee2cd2c4e94f686918587cbc04
MD5 hash: d8e602a22b15c03a28b5f9d9b137b0c8
humanhash: texas-fifteen-venus-thirteen
File name:5a6d7886458e2bf4e05af49a375c0df110893c72568a7f9fd804bbf889e81535
Download: download sample
Signature QuakBot
Create hunting rule
File size:271'872 bytes
First seen:2020-11-12 14:23:30 UTC
Last seen:2024-07-24 14:44:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 015974618e9105226f001019d35e62e5 (1'506 x Quakbot)
ssdeep 6144:DLfhdM/bXZswyIyO6t0nh7lqoDKOAP4PshaoC:nvKbXWNmVHelmEaoC
Threatray 1'228 similar samples on MalwareBazaar
TLSH BD44F22324759436F82607F64DA6D2B14D6E7828AE3145CF2FC85309072F9B28B777DA
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
61
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Lupus-9787367-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5a6d7886458e2bf4e05af49a375c0df110893c72568a7f9fd804bbf889e81535/
Threat name:
Win32.Trojan.PinkSbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 14:26:29 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ljwxrbsfryv7jyc26sndoxan6eiispdsk2fh7h6yas57rcpicu2q._file
Verdict:
malicious
Similar samples:
0220f0aab563c0bdc12685d690436e5fe764f42c7895a80e2eac60f5edffdce6
QuakBot
044df9496396f39de1d8abb5fbf2841d528ecbf3f8c83283176bf6f65ece7325
QuakBot
1a0d3f4c7bb69aeb44ff4e6417a18341c4ecf77ff46280ee771cc4b4e8b30c29
QuakBot
72de8f1fbcaaedd2d9dd2b6ed7404505ceb26bf1943a53feef84fc2f2bf1a9cb
QuakBot
7bed6728c19710fca44a953d80645840d3998372bac97c264ed808e759202080
QuakBot
8850c9af34421bc7dfe2a59ddfbfde0ac0d071cb4bc0f60e96aaffe613eb1382
QuakBot
ca939daa0f3f00aadd7bd1bce4b41f79b5a0ccf716159ed68619c3015122c0ce
QuakBot
df9bb4a3b31c5e5e0c1a6956644988a5f7f6d38694ec3fa599acd765e03a664a
QuakBot
e9cea0a8f4245481b6015d25ef387ab61b32c7ff2f27aac65bf48d1ac71bf5cf
QuakBot
f7cd98f2f61a669efbbfd63ca4c0b1813f2e7dc4c5bfcdba50fd49a262e3cff0
QuakBot
+ 1'218 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201112-kq3jadfy6x/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
988e621113881195193de808526a2ccbf49aec17040885ab0fb494b9cb1df025
MD5 hash:
47038269364bf5422becf57c06854fcf
SHA1 hash:
553b1869f868e1ca1ba1fa81297382468fc662c1
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/e5615718-848c-462f-aa6c-afc8a6443a35/
Parent samples :
8f29ad62267629b927d763f557e10e3d4ed3b77c118c02bb143e51d4b4063d2b
5a6d7886458e2bf4e05af49a375c0df110893c72568a7f9fd804bbf889e81535
SH256 hash:
a704748cdceb5e5f96cd6e131ac644f90a4afe03db1c793970a2336c4a5dea77
MD5 hash:
1724a458d86ec5b7aeda2b0e96176d66
SHA1 hash:
ef53ef5f37d66a0789677dc690d3fdc5d19103e6
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/e5615718-848c-462f-aa6c-afc8a6443a35/
Parent samples :
6ca8c7e8acaec97b05aa175a11e2e474621706a320eca4b1b0096d6a150c162c
d9ea9dc5a145e58531ea7b29cd4e38bbc8c36011590f3fada67f54829d6bd118
8f29ad62267629b927d763f557e10e3d4ed3b77c118c02bb143e51d4b4063d2b
38966308974a1973a0ff01395612965813e52cd3c4929e11b32027a5dd461dd9
5a6d7886458e2bf4e05af49a375c0df110893c72568a7f9fd804bbf889e81535
8df12f8055512ff01c690e1b45777fab03eddaf60845afbfadaa3b3d225e3aec
8460eff35d8d6196b16f1b67cfd1557176138962ce63c1eeb0553a700c84c923
789d5cbf2f1d5cf98ab6c8ed84f472786559f6f1dc8cabc5ddbd48b6f25cfe39
bd35fbaa9b56c8bada6f731b09b9db2297eced473bbbc96d355fe24b43ddd248
c135fe92da22d209e22fc7c9ad83d2456f9f783874b1c9ed9be87fed650510e0
2372c12bf9bb289210f9be4cde76110e2848dd34d3c345df8991698b5f024741
0bda4b37e2a0a89a0272b0a5bc87cc25de33ba4ebf4e4c4b35f5094a455c01c9
SH256 hash:
5a6d7886458e2bf4e05af49a375c0df110893c72568a7f9fd804bbf889e81535
MD5 hash:
d8e602a22b15c03a28b5f9d9b137b0c8
SHA1 hash:
09fddcb6cfebd5ee2cd2c4e94f686918587cbc04
Link:
https://www.unpac.me/results/e5615718-848c-462f-aa6c-afc8a6443a35/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments