MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 71fd7986dd41906e1e868f60a1b89d9d591ea261c45a65848d94b07a0378e31b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Quakbot
Vendor detections: 9
| SHA256 hash: | 71fd7986dd41906e1e868f60a1b89d9d591ea261c45a65848d94b07a0378e31b |
|---|---|
| SHA3-384 hash: | f8828bf440de55e9b5267d940904b1f24d8e33ab34f0e2f8b6d4c927fd144467d403dff8e94d888f78d1f3331cef2528 |
| SHA1 hash: | a1ff7b01bbff503a0087c502c1a353956b808a38 |
| MD5 hash: | f5e796292b2cd1008a449a1608c87e5e |
| humanhash: | bakerloo-jupiter-xray-friend |
| File name: | 443136048108796.dat.dll |
| Download: | download sample |
| Signature | Quakbot |
| File size: | 859'136 bytes |
| First seen: | 2021-05-06 16:41:11 UTC |
| Last seen: | 2021-05-06 17:55:53 UTC |
| File type: |  dll |
| MIME type: | application/x-dosexec |
| imphash | f8b50da2e330b5dea32ae4760264b148 (3 x Quakbot) |
| ssdeep | 12288:+LR2XCmohgp+8RhuxTyAK4X+PAj6iMRbM+bevd6CR/Vr8m+BzcoKCxeEJuBnitAZ:+FaCz8nAO42HzoseEJuBPOu+99z |
| Threatray | 1'388 similar samples on MalwareBazaar |
| TLSH | 8405BF22F2A1CC37D27326789E4B52646D39BE50F93899862FD41E486F343D13B36297 |
| Reporter |  James_inthe_box |
| Tags: | dll Quakbot |
Intelligence
File Origin
# of uploads :
2
# of downloads :
106
Origin country :
n/a
Vendor Threat Intelligence
Detection:
QakBot
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Launching a process
Modifying an executable file
Creating a process with a hidden window
Creating a window
Sending a UDP request
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
92 / 100
Signature
Allocates memory in foreign processes
Contain functionality to detect virtual machines
Contains functionality to detect sleep reduction / modifications
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.BunituCrypt
Status:
Malicious
First seen:
2021-05-06 16:41:02 UTC
File Type:
PE (Dll)
Extracted files:
38
AV detection:
15 of 29 (51.72%)
Threat level:
5/5
Verdict:
malicious
Label(s):
qakbot
Similar samples:
+ 1'378 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
Loads dropped DLL
Unpacked files
SH256 hash:
d801c0315fe7000b64afcfc5d99e02342ba23a13458b1072c5b4dba0172fffc8
MD5 hash:
f344c6876f0660597f9dafeda976126b
SHA1 hash:
1128e8a4c4f415d7e32b7a6f71f358184281c0af
Detections:
win_qakbot_auto
SH256 hash:
71fd7986dd41906e1e868f60a1b89d9d591ea261c45a65848d94b07a0378e31b
MD5 hash:
f5e796292b2cd1008a449a1608c87e5e
SHA1 hash:
a1ff7b01bbff503a0087c502c1a353956b808a38
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Delivery method
Other
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0001.032] Anti-Behavioral Analysis::Timing/Delay Check GetTickCount
1) [B0009.029] Anti-Behavioral Analysis::Instruction Testing
2) [B0012.001] Anti-Static Analysis::Argument Obfuscation
3) [F0002.002] Collection::Polling
5) [C0026.002] Data Micro-objective::XOR::Encode Data
7) [C0051] File System Micro-objective::Read File
8) [C0052] File System Micro-objective::Writes File
9) [E1510] Impact::Clipboard Modification
10) [C0007] Memory Micro-objective::Allocate Memory
11) [C0036.004] Operating System Micro-objective::Create Registry Key::Registry
12) [C0036.003] Operating System Micro-objective::Open Registry Key::Registry
13) [C0036.006] Operating System Micro-objective::Query Registry Value::Registry
14) [C0040] Process Micro-objective::Allocate Thread Local Storage
15) [C0038] Process Micro-objective::Create Thread
16) [C0041] Process Micro-objective::Set Thread Local Storage Value
17) [C0018] Process Micro-objective::Terminate Process