MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c96411f12a48da05040dc9cccf208ae0506bbf1c8d1c2e5a6b02fd5f26eadcf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c96411f12a48da05040dc9cccf208ae0506bbf1c8d1c2e5a6b02fd5f26eadcf0
SHA3-384 hash: ca83f09a4ecffdc7957bad15af605368c70b1fb646ad85a971a4dadf47e4a9b3ae231bbd7de6311acbd3526d4a0afb0f
SHA1 hash: c492e403f629cae29c869f07893edefad9314cc7
MD5 hash: 5dc72a0c6bf4d1c3f612c0dbc9df5265
humanhash: virginia-michigan-louisiana-comet
File name:c96411f12a48da05040dc9cccf208ae0506bbf1c8d1c2e5a6b02fd5f26eadcf0
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'084'416 bytes
First seen:2020-11-07 17:16:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c1e35a855d20d45e9c84f5bd029dd388 (154 x Quakbot)
ssdeep 6144:IkbjqquRgKI4RD83d9kFICdy2MsdNbDhzZ31Ey7EgflnMtjKkfGInR+HlZzmf6Mh:IFDgKJOXxn2M3K2KmfUhulLhJ9FCe
TLSH 833512D7F9BC8471CAED397F8993123C968A85E85D05D10B0778A5ADBDF3200BE9244B
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Forced shutdown of a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c96411f12a48da05040dc9cccf208ae0506bbf1c8d1c2e5a6b02fd5f26eadcf0/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 17:21:43 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zfsbd4jkjdnakbanzhgm6iek4bigxpy4ruoc4wtlal6v6jxk3tya._file
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201108-wkgc2hfbge/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
c96411f12a48da05040dc9cccf208ae0506bbf1c8d1c2e5a6b02fd5f26eadcf0
MD5 hash:
5dc72a0c6bf4d1c3f612c0dbc9df5265
SHA1 hash:
c492e403f629cae29c869f07893edefad9314cc7
Link:
https://www.unpac.me/results/86bc2ac3-af3b-44e9-85ea-0e93c237a95e/
SH256 hash:
f020355c6de8c2b74d97c3035206d03de27460e0028ea76d60d02550fa76d93c
MD5 hash:
d02c1f7295564f910347f1e7bb4d93ab
SHA1 hash:
df5519de0ec1c45f3d28bd6aaf02b9467c09f15c
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/86bc2ac3-af3b-44e9-85ea-0e93c237a95e/
Parent samples :
c96411f12a48da05040dc9cccf208ae0506bbf1c8d1c2e5a6b02fd5f26eadcf0
36f09e30f8b3f4efe845d4e344e847219c9c62a7fa9a61c2d8d70969d19726ec
9d37a0bbc963f04580d4bf12d15c0938f97a7bd299597c8852b818f519f2bac5
a5ca536851022178f40b4690db0c5563020c8b6fcaa22f6c3abd876b72dbccfe
26c106b25d01fae3d0b94af6286d755175af9cf28b99c0b4453548ac375ce890
b65e59778275f64ad2d4ba86a309a5224ccb9179cd7a307c66efb3fc6432c53d
SH256 hash:
6029226fa0c9dd87802309af31f5d473d317a13e88fa5440643c4c46bfb3d273
MD5 hash:
32e994a22d75ede3322d0e69680c4159
SHA1 hash:
52d0fed6c12f9b4a1f26cf0b8d8c78c67865209d
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/86bc2ac3-af3b-44e9-85ea-0e93c237a95e/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments