MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c82375af008feedc04fbaa5ddcc39fb4cb2a8b52fc1f4734121efbba2b4c9a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c82375af008feedc04fbaa5ddcc39fb4cb2a8b52fc1f4734121efbba2b4c9a0
SHA3-384 hash: a713e249eacdd0dc9ec25fc0aa90412c3e3d06d74075fdf2c9cb9f700bc37f771de8ffbd570d812fe43c03ad003c4d39
SHA1 hash: cd88bd76be859ff51d886d585c2371ec2c9bf530
MD5 hash: 086b25d64d9125fc74c73961532f82cf
humanhash: neptune-fifteen-mike-football
File name:9c82375af008feedc04fbaa5ddcc39fb4cb2a8b52fc1f4734121efbba2b4c9a0
Download: download sample
Signature QuakBot
Create hunting rule
File size:277'456 bytes
First seen:2020-11-09 21:10:07 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 015974618e9105226f001019d35e62e5 (1'506 x Quakbot)
ssdeep 6144:1LfhdM/bXZswyIZkEuHrBuYFCAN8XkwDLPZ5:FvKbXWENyuejg75
Threatray 853 similar samples on MalwareBazaar
TLSH 5644F12329799033E0260BB64DB5D3B14C6D78646A7208CF3FD843590A2E5F69B367DB
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.4246.UNOFFICIAL
Create hunting rule

Win.Packed.Lupus-9787366-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9c82375af008feedc04fbaa5ddcc39fb4cb2a8b52fc1f4734121efbba2b4c9a0/
Threat name:
Win32.Trojan.PinkSbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 00:30:10 UTC
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tsbdowxqbd7o3qcpxks53tbz7nglfkfvf7a7i42behx3xivuzgqa._file
Verdict:
malicious
Similar samples:
00518aa68c49a0a26130ddd74c227bd8bc39511ca59b57fd1ac5b2c40932bc5f
QuakBot
07fd3129e86fc448eb752a68f4e7e24aec3bffe0c1223a6f9d7a3b3d507e6d14
QuakBot
55e044458184d43ce58b0c4ed30012ffea51c9f2318f670351c7ced786bc9098
QuakBot
65983fdf282ac701cc9ad42be4109813c2d20f2df605498aaa62119739a31ea7
QuakBot
6ab47419bf714d75e3c815a23306b8750959219378d791d2f94da66bcffc6b80
QuakBot
9bdcba646b1d23d407beed7aaf077b177fdd260b1a6974940817c67952fbc097
QuakBot
a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3
QuakBot
d1ac714a888b82644bc98a1259440be1713fd74158ff2b5884c0585714608529
QuakBot
d21b8d44914b1e5e07633f60ad2f0588f001305e7e6fa759b5e9b8a8acccb283
QuakBot
d946deeeff734644a86d7b254ad9d69f730e2014411404696da19dbd508711c4
QuakBot
+ 843 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201109-88rr5c4gws/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments