MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b8649d3f9fce789feb20de3c8d0c49d23877f77aa6fb4ec2d0e8a92bcf978548. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b8649d3f9fce789feb20de3c8d0c49d23877f77aa6fb4ec2d0e8a92bcf978548
SHA3-384 hash: 9a0a9df995c8f140c1023c675bbc25f22717ada7e840e3faa57fd835095d8da709996a93a672404a8777d992ffa1dffd
SHA1 hash: 95f7b26a874dc870d0ef1e76ed70a83c97576d1a
MD5 hash: ec5786fe2bac2c8cb36b75d103e80881
humanhash: six-diet-beer-dakota
File name:10d2346fca5f7be4ed8bbc8d9c1824f4
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'084'416 bytes
First seen:2020-11-17 12:14:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c1e35a855d20d45e9c84f5bd029dd388 (154 x Quakbot)
ssdeep 6144:/GhDr391i3IfRD83d3kFICdy20sPNbD5EZ31EyIEgfdxktjKkEGInR+HlZzmU6Mh:/QXi3cONxn20aVuKJUUhulLhJ9FCe
Threatray 1'711 similar samples on MalwareBazaar
TLSH AD3522D7F9BC8471CAED29BF8993123C968985E85D05D10B0778A5ADBDF3200FE9244B
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Forced shutdown of a system process
Enabling autorun by creating a file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b8649d3f9fce789feb20de3c8d0c49d23877f77aa6fb4ec2d0e8a92bcf978548/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:18:12 UTC
AV detection:
24 of 28 (85.71%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=xbsj2p47zz4j72za3y6i2dcj2i4hp532u35u5qwq5cusxt4xqvea._file
Verdict:
malicious
Similar samples:
063e0c71b3ede4a7d8a8cd1d1e35432b2e3ce0bf1dfd58c266e93ea91b8895fa
QuakBot
12a33b4cbaa8523b49fbf03ce5ac773e1846660662a0ca67b7dae618606e6ae4
QuakBot
18a52a088f46ae8a4dbfc27760bdb3e22dda61ed353c8b8ff3dc16aaa1df4c43
QuakBot
26c106b25d01fae3d0b94af6286d755175af9cf28b99c0b4453548ac375ce890
QuakBot
5b2a3d67ecebd9a22fc7452f012273a7e5ed5b6331096505aa44f1ac8696c35f
QuakBot
77e8872e2c9a68dceed90a1e59d2805019963759747a1134be407f5bc14ce28b
QuakBot
7e0e9f3a1f1bae034cd67784a804dd40375c5b738f7083c9e337197a296425ef
QuakBot
a401e9208a31cca327a31ee872a258b358dbd276304625e461d46f5c656d5723
QuakBot
b65e59778275f64ad2d4ba86a309a5224ccb9179cd7a307c66efb3fc6432c53d
QuakBot
d8be99a67635ce711c3d165e4e5ad8aad798bc398c92f8be924b5dec534063f0
QuakBot
+ 1'701 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201117-ynwr2wl7rs/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
b8649d3f9fce789feb20de3c8d0c49d23877f77aa6fb4ec2d0e8a92bcf978548
MD5 hash:
ec5786fe2bac2c8cb36b75d103e80881
SHA1 hash:
95f7b26a874dc870d0ef1e76ed70a83c97576d1a
Link:
https://www.unpac.me/results/1953f3ca-2f6a-4141-82ec-0f0cf031c8bd/
SH256 hash:
23fac952b401d2b903ebccd018339555ac003cbc3a602bf6a66856cfe48e5bf7
MD5 hash:
1d97e26a4949e802fd89ffcf2b9c8c25
SHA1 hash:
2fecd868301dc388739a880db4f5895ef1461ace
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/1953f3ca-2f6a-4141-82ec-0f0cf031c8bd/
Parent samples :
e221d41c0509200b65f16de79d39584be8ae05440aacb4ac008da74d5f63d268
827db42a714ce9009c887b8363f4c537a08bb6cdc3b20186c8d1eff604e955ec
a5345cb20dbe087faafdda55d9abf2acb54168524b2d5ab635718e2a6032b47e
cec7871489e459188db78ecc641dfc0cfd9ae7e3ad20daa21395e73ede22e490
1750f06e4ff7e39260edb619e43bc8bf4e349399d841c450391bb571aec04ec1
b8649d3f9fce789feb20de3c8d0c49d23877f77aa6fb4ec2d0e8a92bcf978548
SH256 hash:
deafc5e2f47534a40d8516fab340c63fdb49db311919d42d3b6df63c4d11ec06
MD5 hash:
d66062a9f7b7140877ca6bc3c7e43a99
SHA1 hash:
f8056744530d8ad820f6c6ac30f55a467ad9503a
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/1953f3ca-2f6a-4141-82ec-0f0cf031c8bd/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments