MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ddf021d191640fee8678ccdee0bff82ccca8d4fa552bffd78fb83757bc3fdba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ddf021d191640fee8678ccdee0bff82ccca8d4fa552bffd78fb83757bc3fdba
SHA3-384 hash: 4789535e745cda8fe344c5b3e9902da3c535daf7900f19b87f0b1c495355c4bd4c885a4836e2d87d67514d0e3b31ab8a
SHA1 hash: 9ead0bf2e9f50e103db73c5ffbb1e005fc242e3b
MD5 hash: 5c6694941c8b1cd27223eefe134c0df3
humanhash: connecticut-green-kilo-mike
File name:5ddf021d191640fee8678ccdee0bff82ccca8d4fa552bffd78fb83757bc3fdba
Download: download sample
Signature QuakBot
Create hunting rule
File size:261'080 bytes
First seen:2020-11-07 16:42:53 UTC
Last seen:2020-11-07 16:49:20 UTC
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 3072:1CawmISRvDkMFC2Z0Jy4hoahQ/ii0ueKCfu+XuFKgMLqllq7PCufDfq433wb3lJF:gawCRk4Z0NhbJtWYKjSTfiPZ
TLSH A744E05263E80445F82B96B78C71835016227CA5AB3E5B9D0EC5B37C4E35F716BE071E
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.QakBot.39.31214.3776.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ddf021d191640fee8678ccdee0bff82ccca8d4fa552bffd78fb83757bc3fdba/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 16:44:47 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=lxpqehizczap52dhrtg64c77qlgmvdkpuvjl77ly7obxk66d7w5a._file
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201108-s5j7s4x9nx/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
98c584afd893d90ce739898eb1884b55e0563361ae51bdd661f707598b2c74b4
MD5 hash:
1dc0e5190afd9a815cb196524f9004ba
SHA1 hash:
5718a34f9f4a2d31d601256ea54a4642ff93e173
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/5fce0e33-3e19-41fd-9325-2baa9e01edd3/
Parent samples :
e187fbf6543d1993f0945c04ee520600b6493236bae169a020f9a10c547e249d
572a838c619dd3e50821877544f02fd5666c290645352fecf6e92419fb7dc65e
dcda70b5cc63629dd2760dbc76ffda0bedefd0ee92af4d4e3740acc7dd2eaff2
5ddf021d191640fee8678ccdee0bff82ccca8d4fa552bffd78fb83757bc3fdba
4da932e297755bee1df38f19b60605892d7eec44606bd20317ba4264ee3664fb
07800361c385ebe050c51f65392e9fe7aab7e12163241e5ba5ac80e7e82ca438
SH256 hash:
5ddf021d191640fee8678ccdee0bff82ccca8d4fa552bffd78fb83757bc3fdba
MD5 hash:
5c6694941c8b1cd27223eefe134c0df3
SHA1 hash:
9ead0bf2e9f50e103db73c5ffbb1e005fc242e3b
Link:
https://www.unpac.me/results/5fce0e33-3e19-41fd-9325-2baa9e01edd3/
SH256 hash:
e624b10e045a03150d5a2f053417b06986e10a4d06f408b255c9d666cf077fd8
MD5 hash:
a1ebbe018265ca5f9940499420e194be
SHA1 hash:
f5075914fdbaec476ef163890050ca5c84f2f123
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/5fce0e33-3e19-41fd-9325-2baa9e01edd3/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments