MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96c5af48139b4ce4b2b074e2840d24851a39e80213bcc92b8b733b386eacca9d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96c5af48139b4ce4b2b074e2840d24851a39e80213bcc92b8b733b386eacca9d
SHA3-384 hash: 97be434b1e1771aab53bd8c8079c2e4d0293307bd62afb1798f48436a31d2812aa32e10d1c18bc355d440d9208d8e8a2
SHA1 hash: 089082cb5d19d92e52310c451ba25915da0fcea5
MD5 hash: 74092c47cbe09a860ab857f08659341d
humanhash: mountain-romeo-mars-jupiter
File name:SecuriteInfo.com.Trojan.GenericKDZ.69955.21783.25549
Download: download sample
Signature Quakbot
Create hunting rule
File size:6'010'336 bytes
First seen:2020-09-09 00:49:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9a78c76417431884c38d6c29ae212b7b (15 x Quakbot)
ssdeep 6144:p4thSUHz9HRg1c5Fm0Dq7VTu0Cdvm2MU3Iv7HCuqBl9scWBJg:ch3Hz9HeWFJDmV61AXuu6p
TLSH 6856A0A216C25F8D932F7AF17A7F12E17F428B0850EC59A5C838FD14EA0797C944AB47
Reporter SecuriteInfoCom
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/58027/
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.69955.21783.25549.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Enabling autorun by creating a file
Detection:
qakbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/96c5af48139b4ce4b2b074e2840d24851a39e80213bcc92b8b733b386eacca9d/
Threat name:
Win32.Trojan.QBot
Create hunting rule
Status:
Malicious
First seen:
2020-09-09 00:51:07 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=s3c26sattngojmvqotriidjequndt2acco6msk4lom5tq3vmzkoq._file
Result
Malware family:
n/a
Score:
  6/10
Tags:
persistence
Link:
https://tria.ge/reports/200909-m5q899pka2/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Creates scheduled task(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Adds Run key to start application
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/96c5af48139b4ce4b2b074e2840d24851a39e80213bcc92b8b733b386eacca9d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/58027/

Comments