MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2
SHA3-384 hash: a6f0d483a125092b73c709cbec203535bc401d8f82f592fcc368267dcc706556c69e6157ec54209268f026e81219242c
SHA1 hash: d0f2bcccbcd55826bdfef8c9fd90ace08667e625
MD5 hash: 71fce232e6a876198c3605c441ca4962
humanhash: undress-alpha-princess-twelve
File name:7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'017'320 bytes
First seen:2020-11-14 18:07:25 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 48c67d6a901541a84e7e8bc49cd63032 (21 x Quakbot)
ssdeep 6144:upKCz9OYa5y3g0q+Z1Af61g8nC8StMkuNURdRoc0WKkm5n:CKCpOYsqLjACi8C8vJZkm5n
TLSH E025D02FE737D840C3A82FF646C307A8596BACA5BD22521729D63A1E7DF57D03C22644
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Agen-9774505-0
Create hunting rule

Win.Malware.Qbot-9774584-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-14 18:10:06 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oya63op65xjqkklg6gmiuyb764az5rhh3omfog2iuhpgcsb7ehra._file
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201114-6wsbys4ffe/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2
MD5 hash:
71fce232e6a876198c3605c441ca4962
SHA1 hash:
d0f2bcccbcd55826bdfef8c9fd90ace08667e625
Link:
https://www.unpac.me/results/88ec3f6d-12df-48d0-8b08-7c8a3e3535ab/
SH256 hash:
361231aa8a213f60ea73be0fa534bf3e7c3855c6ae0b9940b71771c7f07414ad
MD5 hash:
bf7ebad66bd4316cd18058c06b4e28f1
SHA1 hash:
5ad652b73077bef68509b344dde1c61e40e6e8c3
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/88ec3f6d-12df-48d0-8b08-7c8a3e3535ab/
Parent samples :
1d14f161830af09dbdfca9bbfa554cd9724f8af548495866b29bddf8b4d73a31
da9694c6c6f520b9068714b76a3cfce6f4609072f8777be7efb4e1878a6c4feb
bda34889cc38db9ca6ff923907e9d1081c81cdf53e62ed5c0991ec9a3e74eef0
1ba4eff0ed556a21a26581b4a59961e33513f5321e5f0310e6d606d5ec95e99e
4b96a68d53022f8246c8e798433f266fdafbbc8902a96713e50eb66548ac3c8a
8ff931fa10085fa391e62db803ee3adc136d0601c1752f685c0951a461ff809f
34a8bdd80f0d5bb6f2f38716cf2d9bf1d0358d1c3778c83c8b7b7bc742b858e8
35b85458c2b654476280aef26c1bde35bbb7a48465a618ae589b9f2e6e305ea8
259b98411afd13efe4d06e088b7d2af806e98d923700237716208e018354e550
acacfdd7a0da6ee94b8c1bff2d71bf406d01a422959f23731d63a485acedf982
b0d5100e6d6af0bff8c9e282989d74930a2878a08410ae27ff2daa96132e3896
e28fd94d327ccd4e1107dc540b1c05cbc824b08a8b40202a6d711384a2de7eb3
fdde58beb1ddc17ee64524912a0db54e7b4bf2ae57cce64eedb01e56c856f582
0dc710737c12ea1c1215fbd39e00347649fff1fb0e512287c86873f66a9f0a35
5a407e99922b9dd18cef43136c16d9fbecd9de47e7895fc4aeb0772487339fc1
034c86795739f7edeec14f4b982b017ecea1c9476bfa304a05de10ebbbdbe425
c520e5788c6cdec1d819803bc214f04a2006ebf0dd3ebfbd56dc5b3a91b38c8b
f0329494b1a9a26aac06e2606c95e31167035d8f576ed8773664d7578913cf36
7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2
SH256 hash:
17c77a8a1a40532859ce9355f65b494c7f513acc7d96a19347474b9f1b4eec9c
MD5 hash:
985e92ea5f4150252868a2790856031a
SHA1 hash:
3afe2068e329a7e95162da5d9c3324df3381f390
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/88ec3f6d-12df-48d0-8b08-7c8a3e3535ab/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/7601edb9feedd3052966f1988a603ff7019ec4e7db98571b48a1de61483f21e2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments