MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5ca536851022178f40b4690db0c5563020c8b6fcaa22f6c3abd876b72dbccfe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5ca536851022178f40b4690db0c5563020c8b6fcaa22f6c3abd876b72dbccfe
SHA3-384 hash: fd3cf6f2f11217f459b8378c0ddb67a6a86100d453b175a49b30218766d027437fe73ffb9ef172f7e4a175b04f13c5b2
SHA1 hash: e66a5fd1a35a8bd9ed1203f652a3f6810198cbea
MD5 hash: e552ccdb5cfd8e2de7b0a5f1dbb9ea54
humanhash: hot-six-september-virginia
File name:a5ca536851022178f40b4690db0c5563020c8b6fcaa22f6c3abd876b72dbccfe
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'084'416 bytes
First seen:2020-11-13 15:34:13 UTC
Last seen:2024-07-24 19:57:13 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c1e35a855d20d45e9c84f5bd029dd388 (154 x Quakbot)
ssdeep 6144:5fRbPkO59SI4RD83d9kFICdy20sBNbDZPZ31EyqEgflKktjKk3GInR+HlZzmf6Mh:5ZV9SJOXxn20jAuK+fUhulLhJ9FCe
Threatray 1'343 similar samples on MalwareBazaar
TLSH 443522D7F9BC8470CAED297F8993123C968A85E85D05D10B0778A5ADBDF3200FE9644B
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Forced shutdown of a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5ca536851022178f40b4690db0c5563020c8b6fcaa22f6c3abd876b72dbccfe/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 15:37:42 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uxffg2craiqxr5ali2inwdcvmmbazc3pzkrc63b2xwdww4w3zt7a._file
Verdict:
malicious
Similar samples:
12a33b4cbaa8523b49fbf03ce5ac773e1846660662a0ca67b7dae618606e6ae4
QuakBot
18a52a088f46ae8a4dbfc27760bdb3e22dda61ed353c8b8ff3dc16aaa1df4c43
QuakBot
36f09e30f8b3f4efe845d4e344e847219c9c62a7fa9a61c2d8d70969d19726ec
QuakBot
63e634708c32b76a6f40c0ccb0b8fb59ecb4e42cbe1f89a2fa56ab41f16fa433
QuakBot
77e8872e2c9a68dceed90a1e59d2805019963759747a1134be407f5bc14ce28b
QuakBot
8d6d8351848925338ce65b442b5bc69872ee467c67e77692645549587eca04d7
QuakBot
9d37a0bbc963f04580d4bf12d15c0938f97a7bd299597c8852b818f519f2bac5
QuakBot
a401e9208a31cca327a31ee872a258b358dbd276304625e461d46f5c656d5723
QuakBot
acb1a2562d23cd06da04a144712d3a0fbe7a7c37cd7532a2f0986803e44554ce
QuakBot
d25368643d599cbdf56c6eb579505b3f21e4b00c8f1c8243cb18040c66751a3b
QuakBot
+ 1'333 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201113-96f1g2gn5x/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
a5ca536851022178f40b4690db0c5563020c8b6fcaa22f6c3abd876b72dbccfe
MD5 hash:
e552ccdb5cfd8e2de7b0a5f1dbb9ea54
SHA1 hash:
e66a5fd1a35a8bd9ed1203f652a3f6810198cbea
Link:
https://www.unpac.me/results/d4c83877-1772-4a62-a24c-bd5524e99538/
SH256 hash:
f020355c6de8c2b74d97c3035206d03de27460e0028ea76d60d02550fa76d93c
MD5 hash:
d02c1f7295564f910347f1e7bb4d93ab
SHA1 hash:
df5519de0ec1c45f3d28bd6aaf02b9467c09f15c
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/d4c83877-1772-4a62-a24c-bd5524e99538/
Parent samples :
c96411f12a48da05040dc9cccf208ae0506bbf1c8d1c2e5a6b02fd5f26eadcf0
36f09e30f8b3f4efe845d4e344e847219c9c62a7fa9a61c2d8d70969d19726ec
9d37a0bbc963f04580d4bf12d15c0938f97a7bd299597c8852b818f519f2bac5
a5ca536851022178f40b4690db0c5563020c8b6fcaa22f6c3abd876b72dbccfe
26c106b25d01fae3d0b94af6286d755175af9cf28b99c0b4453548ac375ce890
b65e59778275f64ad2d4ba86a309a5224ccb9179cd7a307c66efb3fc6432c53d
SH256 hash:
e90a790789a31ab347e49b2c59228cda4fb2c957e5d0b2c99e1d49aa163da810
MD5 hash:
5484391b7ae149fba9e4c6b209ef2f55
SHA1 hash:
9f77002295ff6b01436480c65d989bc7a2ce1a4b
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/d4c83877-1772-4a62-a24c-bd5524e99538/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/a5ca536851022178f40b4690db0c5563020c8b6fcaa22f6c3abd876b72dbccfe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments