MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad80689c092540c7d21490094e35c60032c64e8baed7520cdea9c7b65b044e4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad80689c092540c7d21490094e35c60032c64e8baed7520cdea9c7b65b044e4e
SHA3-384 hash: e0c7c5eae8b04bc5a359565746d8f6e1527f5444f735067f33e60330b816ce8628df5609ad248f0f9c940babcffb4fae
SHA1 hash: daa74badbf7108904e5c9fa7117aebd0dd6abc1c
MD5 hash: a7990e9d97fa3c2bd714e2320bcafdcd
humanhash: king-twelve-black-happy
File name:a7990e9d97fa3c2bd714e2320bcafdcd_55555555
Download: download sample
Signature Quakbot
Create hunting rule
File size:6'010'304 bytes
First seen:2020-09-09 20:26:35 UTC
Last seen:2020-09-09 21:34:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 9a78c76417431884c38d6c29ae212b7b (15 x Quakbot)
ssdeep 6144:54thSUHz9HRg1c5Fm0Dq7VTu0Cdvm2MU3Iv7HCuqBl9scWBJt:Mh3Hz9HeWFJDmV61AXuu68
Threatray 431 similar samples on MalwareBazaar
TLSH 7E56A0A216C25F8D932F7AF17A7F12E17F428B0850EC59A5C838FD14EA0797C944AB47
Reporter Anonymous
Tags:Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
111
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Detection(s):
SecuriteInfo.com.Trojan.GenericKDZ.69955.31144.11294.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Enabling autorun by creating a file
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/462687
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to detect virtual machines (IN, VMware)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 283756 Sample: AH1vVd3cC8 Startdate: 10/09/2020 Architecture: WINDOWS Score: 100 33 Antivirus / Scanner detection for submitted sample 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Yara detected Qbot 2->37 39 3 other signatures 2->39 7 AH1vVd3cC8.exe 4 2->7         started        11 AH1vVd3cC8.exe 2->11         started        13 AH1vVd3cC8.exe 2->13         started        process3 file4 29 C:\Users\user\AppData\Roaming\...\ynuyzfj.exe, PE32 7->29 dropped 31 C:\Users\user\...\ynuyzfj.exe:Zone.Identifier, ASCII 7->31 dropped 43 Detected unpacking (changes PE section rights) 7->43 45 Detected unpacking (overwrites its own PE header) 7->45 47 Contains functionality to detect virtual machines (IN, VMware) 7->47 49 Contains functionality to compare user and computer (likely to detect sandboxes) 7->49 15 ynuyzfj.exe 7->15         started        18 schtasks.exe 1 7->18         started        20 AH1vVd3cC8.exe 7->20         started        signatures5 process6 signatures7 51 Antivirus detection for dropped file 15->51 53 Multi AV Scanner detection for dropped file 15->53 55 Detected unpacking (changes PE section rights) 15->55 57 7 other signatures 15->57 22 explorer.exe 1 15->22         started        25 ynuyzfj.exe 15->25         started        27 conhost.exe 18->27         started        process8 signatures9 41 Contains functionality to compare user and computer (likely to detect sandboxes) 22->41
Detection:
qakbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ad80689c092540c7d21490094e35c60032c64e8baed7520cdea9c7b65b044e4e/
Threat name:
Win32.Trojan.QBot
Create hunting rule
Status:
Malicious
First seen:
2020-09-09 20:28:08 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
073290d55e5af31bd738d65608bea1464c2ac0c8ff0d07cbd9f22e23c2a2c734
Quakbot
0d0d997a7c42c11b60cb1e265b015f2559719f640c2adf1c1bf8b85a434a0d0d
Quakbot
45493d88dd9d1670f48aee096d0ca99110337ffbd4d538dd39b2ef3a13cafa63
Quakbot
4c8150f0b6fb8ae00f0c380cad2efba542489a2691656ae072d487278bfc2874
Quakbot
5cee757e59d42f29564088c4a3eadab65bb557cb1da50f70eafe297b02485174
Quakbot
5e2d7b990c9f6667311a44f7fce078a5bd3e033965db4a31c177bb84b06e8540
Quakbot
78749911faeac0032bb0c8562761fa6ee3fb85f37e099f5169d9dcc29c8024bd
Quakbot
96c5af48139b4ce4b2b074e2840d24851a39e80213bcc92b8b733b386eacca9d
Quakbot
af7c0b516a039a084e5b074c2971e053c9ca3c2690a06e200570e61d58ae9095
Quakbot
b6068e2903cdb4c62a02a8342273e30c757e49fc2b93395df733970fefdd6540
Quakbot
+ 421 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  4/10
Tags:
n/a
Link:
https://tria.ge/reports/200909-e4twjqnywe/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Windows directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ad80689c092540c7d21490094e35c60032c64e8baed7520cdea9c7b65b044e4e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:autogenerated rule brought to you by yara-signator

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

Executable exe ad80689c092540c7d21490094e35c60032c64e8baed7520cdea9c7b65b044e4e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/455600/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/58239/

Comments