MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c802a6eda2feaeefddd216d269c499d4a500eb26e29daa5e65302d812224695b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c802a6eda2feaeefddd216d269c499d4a500eb26e29daa5e65302d812224695b
SHA3-384 hash: 1d6cd0a28f7a2f0fcaae50d8b01aac0650ba7bda4908d8b789a4e63e1244d49112f7dfc86c50b52561b3816fdd5ecaa5
SHA1 hash: ccbfc58fa029e7a3799f41e2061fda13e5515f6a
MD5 hash: 4d551b87a8eff30a29781d4cfd70ad03
humanhash: nineteen-comet-twenty-sodium
File name:c802a6eda2feaeefddd216d269c499d4a500eb26e29daa5e65302d812224695b
Download: download sample
Signature QuakBot
Create hunting rule
File size:277'456 bytes
First seen:2020-11-09 21:25:59 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 015974618e9105226f001019d35e62e5 (1'506 x Quakbot)
ssdeep 6144:ZLfhdM/bXZswyIZkEuHrBuYFCAN8XkwDLP34:5vKbXWENyuejg54
Threatray 853 similar samples on MalwareBazaar
TLSH 6844F12369759032E4260BB64DB5D3714C7D78646A3208CF2FD803590A2E9F6DB367DB
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Inject4.4246.UNOFFICIAL
Create hunting rule

Win.Packed.Lupus-9787366-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c802a6eda2feaeefddd216d269c499d4a500eb26e29daa5e65302d812224695b/
Threat name:
Win32.Trojan.PinkSbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-10 00:40:45 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zabkn3nc72xo7xosc3jgtrez2ssqb2zg4ko2uxtfgawycirenfnq._file
Verdict:
malicious
Similar samples:
00518aa68c49a0a26130ddd74c227bd8bc39511ca59b57fd1ac5b2c40932bc5f
QuakBot
30a37091398c28d86d8d13713ef305bdb788afaf278318088811e98169d8e5c0
QuakBot
4c79778a10d1b6eabfa425cc031041eceb47e06c7499069607b13975158dc481
QuakBot
5015651d1537f3949aba94aba1a295909ac687a6966afc07fe1a784be3bfa784
QuakBot
65983fdf282ac701cc9ad42be4109813c2d20f2df605498aaa62119739a31ea7
QuakBot
671e5c87b1fea0452fe8517d4d35b6e86963edbd7c02442c0934cc38d826629f
QuakBot
74809f63f3e96d4f4897e123e2783c5ed37e9688c10b213ace75153024de26c7
QuakBot
9bdcba646b1d23d407beed7aaf077b177fdd260b1a6974940817c67952fbc097
QuakBot
ae6c68d1ba34c997cb9a55ed0e016a457d1bb84680eee0a97d5362b0312d03b0
QuakBot
afb04ccb08e70f8364ab5550702d3700ec8a4e288f784d9d3a0c2d87731f9241
QuakBot
+ 843 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201109-bxgmnjsgqx/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c802a6eda2feaeefddd216d269c499d4a500eb26e29daa5e65302d812224695b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments