MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c6f9bba14dfb1e7b6a8dd697ae6ba69181d5af7cccf6dd40b89516d5ea483c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5c6f9bba14dfb1e7b6a8dd697ae6ba69181d5af7cccf6dd40b89516d5ea483c3
SHA3-384 hash: 8ead606346d0f4e4a3071be0da9994041251e48e4943e1ebece5a8edac343d643b56018a071d7edb03558e0f44d664df
SHA1 hash: edb4c891aeee9bafce87edae7bf6192d390ee0ed
MD5 hash: 0b95ec4cb578eb2a6f6b749628883ada
humanhash: mobile-uncle-batman-alpha
File name:0b95ec4cb578eb2a6f6b749628883ada.exe
Download: download sample
Signature Quakbot
Create hunting rule
File size:1'094'120 bytes
First seen:2020-11-12 09:20:05 UTC
Last seen:2024-07-24 14:50:02 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash ba5c263c6125faae2c597950f7826711 (27 x Quakbot)
ssdeep 12288:sqflDDoYeF20NNHCW8k45hox9l7pUHcX6EQ2Xbh7:s00E0NNHCWZmO7aHCNb5
Threatray 1'093 similar samples on MalwareBazaar
TLSH 2D35011BE1E35BCBE483417C69E280BA9532EF8DDB1BD47B2A18F1D871B63C5851E604
Reporter abuse_ch
Tags:exe Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BScope.Trojan.Cobalt.27766.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5c6f9bba14dfb1e7b6a8dd697ae6ba69181d5af7cccf6dd40b89516d5ea483c3/
Threat name:
Win32.Ransomware.WannaCry
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 09:21:05 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
12a59869c0e78eed60e76adc9c592ba8b9f3d2835f19d4c46e7a458739d6aedf
Quakbot
392d376d3dd5eae34f3fe70f72385ace530cde7232a0f1527abb0c052ed27580
Quakbot
430ea9414b34feb3b1f55c0d873e77513181476b3738b34ce4a3bb4ec464aab9
Quakbot
6a25eecf4c09687ee9eb25089d656e75b86b83464b681f08d14d7cd9fa468a6d
Quakbot
a1093cae5947b010c760dc1e04d9ac932b45dfe46f67b38b8f5b37c807084261
Quakbot
ac8e462f7c815d034964fa3b9d37c356eefff9105a02fa13c45f86c5e3254bad
Quakbot
b62204e7ac2de6eb620fc2849593ab3bf50132836a5b648d572fd728c2404e72
Quakbot
cebb5bb7177a20961e79e4609e2789adec6b38a9d91269794f9fcbed6fea73af
Quakbot
d5f719a5fb651053def370762beb99e78cf222f02d57ddb185b574dfe91627dc
Quakbot
eb9915d87fd32bf37ff5e764a80b6fb4957598433774ae9fed10f82d932dba0c
Quakbot
+ 1'083 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201112-akkw85w56j/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
5c6f9bba14dfb1e7b6a8dd697ae6ba69181d5af7cccf6dd40b89516d5ea483c3
MD5 hash:
0b95ec4cb578eb2a6f6b749628883ada
SHA1 hash:
edb4c891aeee9bafce87edae7bf6192d390ee0ed
Link:
https://www.unpac.me/results/56b4f4ce-ce12-464d-943a-38d659ac090b/
SH256 hash:
941895d7884737991f56f8c08e2f4cb3e9b5fe392fc4d605a38c094fd6e55076
MD5 hash:
92012015d9188eddfec78788266c0a1b
SHA1 hash:
b41c96a019524e442ee689868914b0b570367288
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/56b4f4ce-ce12-464d-943a-38d659ac090b/
SH256 hash:
22a5f7747bbe1b7e35ed9271470d0622872340be9d63ab809bf438d7e976153a
MD5 hash:
1d862a50217a4163bcf0f77f1ade0cb3
SHA1 hash:
b460f0cf9396434570f82d505ccaf3179e226df5
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/56b4f4ce-ce12-464d-943a-38d659ac090b/
Parent samples :
b62204e7ac2de6eb620fc2849593ab3bf50132836a5b648d572fd728c2404e72
eb9915d87fd32bf37ff5e764a80b6fb4957598433774ae9fed10f82d932dba0c
cebb5bb7177a20961e79e4609e2789adec6b38a9d91269794f9fcbed6fea73af
5c6f9bba14dfb1e7b6a8dd697ae6ba69181d5af7cccf6dd40b89516d5ea483c3
54143d46ffc8e27ed096659781ace6b86d64e60c6824a59104816f6b2eab0905
9003653bd1f19432eb423ccf719c2de2189663b4240704d9eef95144945b348f
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

Executable exe 5c6f9bba14dfb1e7b6a8dd697ae6ba69181d5af7cccf6dd40b89516d5ea483c3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/807969/
  
Delivery method
Distributed via web download

Comments