MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d54daee0244973fcaa6015389c9bb35ef5bfe00b641066be0d29950928a05dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d54daee0244973fcaa6015389c9bb35ef5bfe00b641066be0d29950928a05dd
SHA3-384 hash: a681b16640e87d4be2682aa0618e39e8bf3cc0d7b20d87732f56e703bab6f008320befca9406216bbf7b7d3924f697d5
SHA1 hash: 17f58606bf9bf6b72d89001b5d4f6cdc20ddcc66
MD5 hash: 9077be1b5ff46b0526ef8849666e7478
humanhash: stairway-virginia-spaghetti-eight
File name:5d54daee0244973fcaa6015389c9bb35ef5bfe00b641066be0d29950928a05dd
Download: download sample
Signature QuakBot
Create hunting rule
File size:261'080 bytes
First seen:2020-11-09 21:27:45 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:1CawmISRvDkMFC2Z0Jy4hoahQ/ii0ueKCfu+XuFKgMLqllq7PCufDfq433wb3XJM:gawCRk4Z0NhbJtWYKjSTfiUZ
Threatray 853 similar samples on MalwareBazaar
TLSH 7B44E05263E80444F82B97B78C71835016267CA5AB3E5A9D0EC5B37C4E35FB16BE072E
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.QakBot.39.31214.3776.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d54daee0244973fcaa6015389c9bb35ef5bfe00b641066be0d29950928a05dd/
Threat name:
Win32.Trojan.PinkSbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 00:41:48 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lvknv3qcislt7svgafjytsn3gxxvx7qawzaqm27a2kmvbeukaxoq._file
Verdict:
malicious
Similar samples:
28073d4484050c1d52ea7be1a8c94a554387311529909fc451525872af5b1164
QuakBot
303121f6de8cf468ba8556e3da25d7b4ce3d326d97125ab1fb677335d7f58e64
QuakBot
3ad143fe091e2398207ac89ed82cc31f5bee574def93abd938e001b35898fbbc
QuakBot
46c407bc6a89726389f73de450a801d6d14a9fb97447f2fd449514cbcf33baad
QuakBot
73efa825c8ac05d163d714fa32c9761a7850b3955207690ebacf661cdfb15f9f
QuakBot
9f90bdf9ba391e45d111d84c6f59f074410928c306feef877ee9e1a2e0668f16
QuakBot
d1457d2c3473bab86d18d4cf8b4f74647eb6a2cb0979666a30a4f85fe8e23f9d
QuakBot
d1bb3f027353c0a0714df4f1078d9cd0682c81e7bb27aa9e60abf04c3ea5059b
QuakBot
d9b5e7443c3d48d18c5da2ce0dbd958cdc6eac082bede6ba35a8531a5a39470e
QuakBot
e55c191f081d06d46846f73db4d847c3a08da2a517b70ee119f2586c308ebd1d
QuakBot
+ 843 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201109-4xby9m8xvn/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5d54daee0244973fcaa6015389c9bb35ef5bfe00b641066be0d29950928a05dd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments