MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93062f1a1c0b4b04c62355d3ee310dcaacb301cd1980ce9ebef89fb3963a40ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93062f1a1c0b4b04c62355d3ee310dcaacb301cd1980ce9ebef89fb3963a40ef
SHA3-384 hash: 2b92a60c132dea057cedaed36e822ce2270ae0a1c6bbbb97623cb9f8fe79d454e868cc3eb50a05e8d18434b8d48e5950
SHA1 hash: 59a4577580629b8a973dfa76258a280137bd9608
MD5 hash: f917647d004d238370240cfc7d0814a2
humanhash: wisconsin-lithium-bravo-jersey
File name:93062f1a1c0b4b04c62355d3ee310dcaacb301cd1980ce9ebef89fb3963a40ef
Download: download sample
Signature QuakBot
Create hunting rule
File size:959'480 bytes
First seen:2020-11-06 11:07:54 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 26a69d12ffc2f1bc1c4a71f01c654d31 (7 x QuakBot)
ssdeep 6144:mv4Jb6PYNgiQsyaxAUyetu9ITzmXG33wXd5FLY9C3DzkgJkw20y:mgWPYe4ueQ9ITz8GnwXbFsWDzl+0y
Threatray 777 similar samples on MalwareBazaar
TLSH 4C15E001FD78DD06D2A52D7C4E2617B89E8B78C4EC13605376AA5F6CBCF23A2AC5E405
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Razy-9775963-0
Create hunting rule

Win.Trojan.Qbot-9776853-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93062f1a1c0b4b04c62355d3ee310dcaacb301cd1980ce9ebef89fb3963a40ef/
Threat name:
Win32.Trojan.QBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-14 03:14:00 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=smdc6gq4bnfqjrrdkxj64minzkwlgaondgam5hv67cp3hfr2idxq._file
Verdict:
malicious
Similar samples:
07dc705da27544ca4d232515c665dff2bbbf6b0ab49fd07c602e20d6a512b4af
QuakBot
24a34d20d4da6b342302df550bc8db993541711548d0adf539e0e4f31afce72c
QuakBot
28a2431ffd24d8041bdbf471fcc3eebb98c9e53c980617e4c468f7ad9cdf9d31
QuakBot
71f24bd6e0a181c04f0fabc5801480a4e3991d2fdf8b35a72b1e91c60ba3eb03
QuakBot
8b4b8a5cfdf150e134bf441bcabdb60d37508bfb973a038a610386341420317f
QuakBot
bfb48416b0557ef0d47177d809287384f47d0bf985504ee9b243d7161293364e
QuakBot
c14b93f3949b9cc4ba3163a23b5cfeb1d4bea17db91703c3cdcccccbb57d2058
QuakBot
c537e20b181e0bd13cc919d2decb053e56aad510f0c4011d10454ce8a2339037
QuakBot
e2d5f4c171dc88b453be93a2b940a815143657952863fe6daf32bdd01ed1577d
QuakBot
f3e3d35760f655af5a57029b73c2cc2f42d09de1a694b2eb22366a3e6c49a068
QuakBot
+ 767 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201106-mzdvybqkne/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
93062f1a1c0b4b04c62355d3ee310dcaacb301cd1980ce9ebef89fb3963a40ef
MD5 hash:
f917647d004d238370240cfc7d0814a2
SHA1 hash:
59a4577580629b8a973dfa76258a280137bd9608
Link:
https://www.unpac.me/results/fa4a4791-e5a1-4369-9952-8f7ccfb9f859/
SH256 hash:
a29448ae480bc46253bd3c0d9c2467dd041cefd456bb5a7ec8f98c40c73451bc
MD5 hash:
acf407ae776dfb1332ea31bbbcc52bd0
SHA1 hash:
731176cbd6e6845081c9ed4bc039caf6b2e1bb49
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/fa4a4791-e5a1-4369-9952-8f7ccfb9f859/
Parent samples :
bfb48416b0557ef0d47177d809287384f47d0bf985504ee9b243d7161293364e
e2d5f4c171dc88b453be93a2b940a815143657952863fe6daf32bdd01ed1577d
c537e20b181e0bd13cc919d2decb053e56aad510f0c4011d10454ce8a2339037
93062f1a1c0b4b04c62355d3ee310dcaacb301cd1980ce9ebef89fb3963a40ef
58228a52b83bbd17d6ac52cd52767ebfe01327787b218f9c41ad66c1702bb62b
85753f341c17caad8c49790a7b6beb6ddca9f6106c54ece912203e77baa9aa09
SH256 hash:
04085a5cc23bdf7e50c6cbdfb5ea0341356c9548b7dcad674174b2d95a261d09
MD5 hash:
270ac8c3fae3f1402b01eaed46f68445
SHA1 hash:
ddabd63336ae9888fce560a9866a4b4651fbd997
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/fa4a4791-e5a1-4369-9952-8f7ccfb9f859/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments