MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b62204e7ac2de6eb620fc2849593ab3bf50132836a5b648d572fd728c2404e72. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b62204e7ac2de6eb620fc2849593ab3bf50132836a5b648d572fd728c2404e72
SHA3-384 hash: 49342c46dc4480cbad60c7c300dad7e82884649a9f4efe97f102b034a13f1ad0c30b8afede9d57cbee2b194a7bc7f4a8
SHA1 hash: e28cca7bce33124f73e933ab6c3de2e27d992e53
MD5 hash: 424bcacf8cd9d724d0ea35b18cba9307
humanhash: xray-rugby-nitrogen-echo
File name:SecuriteInfo.com.BScope.Trojan.Cobalt.26349
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'093'200 bytes
First seen:2020-11-11 15:01:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3cff6a264a1d694a36fac2c685f6a919 (9 x QuakBot)
ssdeep 12288:pqflDDoYeF20NNHCW8k45hox9l7pUHQX6EQ2XbhiVO:p00E0NNHCWZmO7aHmNbcVO
Threatray 1'086 similar samples on MalwareBazaar
TLSH 5B35011BE1E35BDBE49380BC69E2917A9132EF8DDB1BD43B2A18F19871B23C5491F504
Reporter SecuriteInfoCom
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.BScope.Trojan.Cobalt.26349.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b62204e7ac2de6eb620fc2849593ab3bf50132836a5b648d572fd728c2404e72/
Threat name:
Win32.Trojan.PinkSbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-11 19:05:25 UTC
AV detection:
24 of 29 (82.76%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wyrajz5mfxtowyqpykcjle5lhp2qcmudnjnwjdkxf7lsrqsajzza._file
Verdict:
malicious
Similar samples:
12a59869c0e78eed60e76adc9c592ba8b9f3d2835f19d4c46e7a458739d6aedf
QuakBot
392d376d3dd5eae34f3fe70f72385ace530cde7232a0f1527abb0c052ed27580
QuakBot
430ea9414b34feb3b1f55c0d873e77513181476b3738b34ce4a3bb4ec464aab9
QuakBot
4e21f2eefe25c07034fe9a8dc009cf05b33fd4d94979200921cf61f6efd15654
QuakBot
6a25eecf4c09687ee9eb25089d656e75b86b83464b681f08d14d7cd9fa468a6d
QuakBot
a1093cae5947b010c760dc1e04d9ac932b45dfe46f67b38b8f5b37c807084261
QuakBot
ac8e462f7c815d034964fa3b9d37c356eefff9105a02fa13c45f86c5e3254bad
QuakBot
cdd0849cc7c21652c39ffdbdc039bc211b2044003c97c6bd964fca15012bd4d5
QuakBot
d5f719a5fb651053def370762beb99e78cf222f02d57ddb185b574dfe91627dc
QuakBot
fe1709b0d7285955a4d6a09746fab6982d2a737df6dd0d1bde2e1699a1928fd3
QuakBot
+ 1'076 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201111-ttwc4hpeq6/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
b62204e7ac2de6eb620fc2849593ab3bf50132836a5b648d572fd728c2404e72
MD5 hash:
424bcacf8cd9d724d0ea35b18cba9307
SHA1 hash:
e28cca7bce33124f73e933ab6c3de2e27d992e53
Link:
https://www.unpac.me/results/42c63a73-545c-496f-b995-d287935be6af/
SH256 hash:
f877e206e9e399eb68a2f16ca4ace50541f63e4593de9d86f5468e683c2f176d
MD5 hash:
6fc6570f96caee56b978da1cea720691
SHA1 hash:
455f00fc957a69fc4b22e65509e3660356e1a9b4
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/42c63a73-545c-496f-b995-d287935be6af/
SH256 hash:
22a5f7747bbe1b7e35ed9271470d0622872340be9d63ab809bf438d7e976153a
MD5 hash:
1d862a50217a4163bcf0f77f1ade0cb3
SHA1 hash:
b460f0cf9396434570f82d505ccaf3179e226df5
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/42c63a73-545c-496f-b995-d287935be6af/
Parent samples :
b62204e7ac2de6eb620fc2849593ab3bf50132836a5b648d572fd728c2404e72
eb9915d87fd32bf37ff5e764a80b6fb4957598433774ae9fed10f82d932dba0c
cebb5bb7177a20961e79e4609e2789adec6b38a9d91269794f9fcbed6fea73af
5c6f9bba14dfb1e7b6a8dd697ae6ba69181d5af7cccf6dd40b89516d5ea483c3
54143d46ffc8e27ed096659781ace6b86d64e60c6824a59104816f6b2eab0905
9003653bd1f19432eb423ccf719c2de2189663b4240704d9eef95144945b348f
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuakBot

Executable exe b62204e7ac2de6eb620fc2849593ab3bf50132836a5b648d572fd728c2404e72

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/807207/
  
Delivery method
Distributed via web download

Comments