MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e8cde7e5df5e1aaf6addee434e442ff86d10ea4c1b65548a5e8544d0023019f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e8cde7e5df5e1aaf6addee434e442ff86d10ea4c1b65548a5e8544d0023019f
SHA3-384 hash: 45d74c69e37c66e4ee93c77fa48d1fb25522c4c0c52e3836ec9b6ed8f932f23b2bda514e91543458a7f6062559bc3873
SHA1 hash: 3b240ec4115100557967f2901af9b3bab6317e72
MD5 hash: fab67ead24faf755de7faaf2fd298e90
humanhash: october-aspen-nebraska-utah
File name:SecuriteInfo.com.Troj.Qbot-FS.5397.9130
Download: download sample
Signature Quakbot
Create hunting rule
File size:762'368 bytes
First seen:2020-05-21 17:51:07 UTC
Last seen:2020-05-21 18:38:14 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f775e5f2c7122a9f4550feacec30f2d0 (8 x Quakbot)
ssdeep 12288:IgU3965wVaFgq6LuM+0D2PNEt3vxNIGe/erLIX:mkFgdnUVEm9erLI
Threatray 420 similar samples on MalwareBazaar
TLSH 30F47A0BEA7F4367DCC68A31CDBDB53A411A6CBBD23693067100FE9E9AF225115D62C1
Reporter SecuriteInfoCom
Tags:Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
110
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Troj.Qbot-FS.5397.9130.UNOFFICIAL
Create hunting rule

Gathering data
Threat name:
Win32.Trojan.Qbot
Create hunting rule
Status:
Malicious
First seen:
2020-05-21 18:35:22 UTC
File Type:
PE (Exe)
Extracted files:
110
AV detection:
26 of 31 (83.87%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
0758b43a955dc7f5f529c71d6100de1e0d91ffc50979bf9cda950e4d2fe6545a
Quakbot
0ba28e54028cd866c9d7baec0fe4a46bfe37e77f1d5c89114920cf58c540993f
Quakbot
11105b9bfa8c28853cbd8e79e1adde11ba44f28b6503c23b5dc0e9c557d34676
Quakbot
2e7650d1d701d1ecbe80d3067e55978d1986f3165046b4c726a1c7baf91cf7ac
Quakbot
3d8bc67bb77836ec4d9e2ab1e32a825aad31b5367fe2aa82d50fd6175ce3932f
Quakbot
473e36272f2ee075898de211b5697144b6f5b96ae87b7944ec06f017e18a0566
Quakbot
8a827ae438d49f48d3a737f838b29aa5ba62d3642d85f8c9a3ebd0b6ccda8ed8
Quakbot
b840d427761bd6b69b6dbdfda6d4ac764f6cc0116c6b932b66a47886aca3be77
Quakbot
e2e79a41086f5e3cdb09c6cd64bc7e474d5fa9dd503004924c74c365e85c5efd
Quakbot
face4965333ed1843cb00bbac6e623824373f78f5c10030f5e5c046011556090
Quakbot
+ 410 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  9/10
Tags:
n/a
Link:
https://tria.ge/reports/201109-xtna86mpkn/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments