MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d37a0bbc963f04580d4bf12d15c0938f97a7bd299597c8852b818f519f2bac5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d37a0bbc963f04580d4bf12d15c0938f97a7bd299597c8852b818f519f2bac5
SHA3-384 hash: 1de33009ed4a1b83d218cc73c408fe12df6569f033768b074370ee75a9d23df0ca7bb34af87cf06f36e284bf07ae90a2
SHA1 hash: 7f71ecd70d79d645025ab5a86c929bf7f9581715
MD5 hash: 26ea0761401f86ce6d6ee2a0ac048cbc
humanhash: pennsylvania-finch-california-moon
File name:9d37a0bbc963f04580d4bf12d15c0938f97a7bd299597c8852b818f519f2bac5
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'084'416 bytes
First seen:2020-11-12 14:27:42 UTC
Last seen:2024-07-24 19:38:07 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c1e35a855d20d45e9c84f5bd029dd388 (154 x Quakbot)
ssdeep 6144:TRt8TgGnZwBrIARD83dtkFICdy20smNbDh3Z31EybEgfdXMtjKkfGInR+HlZzmfR:TRTaeBrhOnxn20cO2KmfUhulLhJ9FCe
Threatray 1'249 similar samples on MalwareBazaar
TLSH 573522D7F9BC8471CAED297F8993123C968A85E85D05D10B0778A5ADBDF3200FE9244B
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
67
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Forced shutdown of a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d37a0bbc963f04580d4bf12d15c0938f97a7bd299597c8852b818f519f2bac5/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-12 14:30:48 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tu32bo6jmpyelagux4jncxajhd4xu66stfmxzccsxampkgpsxlcq._file
Verdict:
malicious
Similar samples:
279c511ba3dd0151e5c969eeb34924fbdb4707d0ccd4d0ac36dc9f63324a7582
QuakBot
36f09e30f8b3f4efe845d4e344e847219c9c62a7fa9a61c2d8d70969d19726ec
QuakBot
3ca3e5b6d16a79254fc3a225630ba6ccce14af026d05a7d07d52035f556c2743
QuakBot
73d8eec4558786e302ac9d8d4252a60eebdf4f66eec9925b58d437dbaa5d826e
QuakBot
77e8872e2c9a68dceed90a1e59d2805019963759747a1134be407f5bc14ce28b
QuakBot
8d6d8351848925338ce65b442b5bc69872ee467c67e77692645549587eca04d7
QuakBot
96e21a6d02770fdff74ac912154f8c7c7a934d7236360485920c8550fa0050a1
QuakBot
acb1a2562d23cd06da04a144712d3a0fbe7a7c37cd7532a2f0986803e44554ce
QuakBot
cbea93d2d24af4fa47dfa9e359a44452f31bff6d65f194cc720684e48a2c90f5
QuakBot
ce42bacf0b5fc43144e33f10aeb9de744de818f85dc44da62b05e64204c42580
QuakBot
+ 1'239 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201112-n2ca423rvn/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
9d37a0bbc963f04580d4bf12d15c0938f97a7bd299597c8852b818f519f2bac5
MD5 hash:
26ea0761401f86ce6d6ee2a0ac048cbc
SHA1 hash:
7f71ecd70d79d645025ab5a86c929bf7f9581715
Link:
https://www.unpac.me/results/f2efdfe8-14d2-4d8b-9453-fb5415a8b5c7/
SH256 hash:
f020355c6de8c2b74d97c3035206d03de27460e0028ea76d60d02550fa76d93c
MD5 hash:
d02c1f7295564f910347f1e7bb4d93ab
SHA1 hash:
df5519de0ec1c45f3d28bd6aaf02b9467c09f15c
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/f2efdfe8-14d2-4d8b-9453-fb5415a8b5c7/
Parent samples :
c96411f12a48da05040dc9cccf208ae0506bbf1c8d1c2e5a6b02fd5f26eadcf0
36f09e30f8b3f4efe845d4e344e847219c9c62a7fa9a61c2d8d70969d19726ec
9d37a0bbc963f04580d4bf12d15c0938f97a7bd299597c8852b818f519f2bac5
a5ca536851022178f40b4690db0c5563020c8b6fcaa22f6c3abd876b72dbccfe
26c106b25d01fae3d0b94af6286d755175af9cf28b99c0b4453548ac375ce890
b65e59778275f64ad2d4ba86a309a5224ccb9179cd7a307c66efb3fc6432c53d
SH256 hash:
efc25a7ac126171ac640f32caf0fcef2e1a8199c18e9c6cd915682da74e3c19b
MD5 hash:
943b4b1cc8967d43c2b7bc7857d87630
SHA1 hash:
a8373b3cbf761c7b58306521e1a64d737aeb978e
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/f2efdfe8-14d2-4d8b-9453-fb5415a8b5c7/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments