MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 85753f341c17caad8c49790a7b6beb6ddca9f6106c54ece912203e77baa9aa09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 85753f341c17caad8c49790a7b6beb6ddca9f6106c54ece912203e77baa9aa09
SHA3-384 hash: 6695c5d7b1c4361bbf150055f5afe3656d82818ba49ec1097d728e554430d1e610add888efbd18567d40cf0b0bb5e8a4
SHA1 hash: 11019e06344f7d975f5bd6d9c4e6e79f302367e1
MD5 hash: 385b0dc88f9ba74e48f81ca9bb21a139
humanhash: nebraska-cardinal-pennsylvania-snake
File name:85753f341c17caad8c49790a7b6beb6ddca9f6106c54ece912203e77baa9aa09
Download: download sample
Signature QuakBot
Create hunting rule
File size:959'480 bytes
First seen:2020-11-13 15:10:33 UTC
Last seen:2024-07-24 18:20:57 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 26a69d12ffc2f1bc1c4a71f01c654d31 (7 x QuakBot)
ssdeep 6144:0sJ6PYNgiQsyaxAUyetu9ITzmXG33wXd5FLY9C3DzkgJkw20y:IPYe4ueQ9ITz8GnwXbFsWDzl+0y
TLSH 5F15F101FD78DD06D2A52E7C4E2617B89E8B78C4EC13905376EA4F6CACF63B2985E405
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
56
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Razy-9775963-0
Create hunting rule

Win.Trojan.Qbot-9776853-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/85753f341c17caad8c49790a7b6beb6ddca9f6106c54ece912203e77baa9aa09/
Threat name:
Win32.Trojan.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 15:11:25 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qv2t6na4c7fk3dcjpefhw27lnxokt5qqnrkoz2isea7hpovjvieq._file
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201113-3nrfd5ah86/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
85753f341c17caad8c49790a7b6beb6ddca9f6106c54ece912203e77baa9aa09
MD5 hash:
385b0dc88f9ba74e48f81ca9bb21a139
SHA1 hash:
11019e06344f7d975f5bd6d9c4e6e79f302367e1
Link:
https://www.unpac.me/results/365d0ea0-dd09-4d36-a8f7-4a1ece9a0be9/
SH256 hash:
a29448ae480bc46253bd3c0d9c2467dd041cefd456bb5a7ec8f98c40c73451bc
MD5 hash:
acf407ae776dfb1332ea31bbbcc52bd0
SHA1 hash:
731176cbd6e6845081c9ed4bc039caf6b2e1bb49
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/365d0ea0-dd09-4d36-a8f7-4a1ece9a0be9/
Parent samples :
bfb48416b0557ef0d47177d809287384f47d0bf985504ee9b243d7161293364e
e2d5f4c171dc88b453be93a2b940a815143657952863fe6daf32bdd01ed1577d
c537e20b181e0bd13cc919d2decb053e56aad510f0c4011d10454ce8a2339037
93062f1a1c0b4b04c62355d3ee310dcaacb301cd1980ce9ebef89fb3963a40ef
58228a52b83bbd17d6ac52cd52767ebfe01327787b218f9c41ad66c1702bb62b
85753f341c17caad8c49790a7b6beb6ddca9f6106c54ece912203e77baa9aa09
SH256 hash:
ba8a9f471bac38af8d5f35e7dd12c3d78432aeb75a79d514ac3daaf3ddf571ee
MD5 hash:
083b10d64592d52228d6225e9c251d46
SHA1 hash:
98cacfb22f662aa628c66f2aa7de486d11297582
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/365d0ea0-dd09-4d36-a8f7-4a1ece9a0be9/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments