MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca969bc3c98f90de5ea8bc25056b2267648098a33586bcca79ae432509d95c43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca969bc3c98f90de5ea8bc25056b2267648098a33586bcca79ae432509d95c43
SHA3-384 hash: 9aab28e0266bf3a5af7951033e6859644cc80a7a6d9fffe2f2af75f5fcf82d00f89600cae629c83752bd1337cc9d2d3a
SHA1 hash: 7f70e49bb968656cb14e79eeca3ff523443a1d61
MD5 hash: be4c7ef81d021238f31a9370a262061b
humanhash: aspen-fillet-bravo-low
File name:ca969bc3c98f90de5ea8bc25056b2267648098a33586bcca79ae432509d95c43
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'424'360 bytes
First seen:2020-11-07 17:38:37 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4b5837b6418a28d2cc27085fa11f0a6a (45 x QuakBot)
ssdeep 12288:/NIpBnBy4I8boL74hxWi1ZJUnoRsG3+etdB:uB68bGExWi1QnoRV3+etdB
Threatray 789 similar samples on MalwareBazaar
TLSH DA652387B778C882C6D905788E5737DC7B4677988E81D04A59E4A92CECF22467ED380F
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Generickdz-9781418-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ca969bc3c98f90de5ea8bc25056b2267648098a33586bcca79ae432509d95c43/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 17:45:17 UTC
AV detection:
27 of 29 (93.10%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zkljxq6jr6in4xvixqsqk2zcm5sibgfdgwdlzstzvzbskcozlrbq._file
Verdict:
malicious
Similar samples:
0d0d997a7c42c11b60cb1e265b015f2559719f640c2adf1c1bf8b85a434a0d0d
QuakBot
2a9ab4b103557c2e45afb9b59ae9243866209cf755fc3435f717439df0871488
QuakBot
45493d88dd9d1670f48aee096d0ca99110337ffbd4d538dd39b2ef3a13cafa63
QuakBot
5e2d7b990c9f6667311a44f7fce078a5bd3e033965db4a31c177bb84b06e8540
QuakBot
76dfd774e997c6f57436d26f9687330780fb4e531be2ac87b987f59caf9420c3
QuakBot
78749911faeac0032bb0c8562761fa6ee3fb85f37e099f5169d9dcc29c8024bd
QuakBot
9ea960fd878163f83b9712993d5d909fbff31601e76b54a4278a282c1526d835
QuakBot
aab0cda9f1d257a3affd8ee4c8b7eb06369d598afa2a1daa3f0780851fc083cc
QuakBot
af7c0b516a039a084e5b074c2971e053c9ca3c2690a06e200570e61d58ae9095
QuakBot
e187fbf6543d1993f0945c04ee520600b6493236bae169a020f9a10c547e249d
QuakBot
+ 779 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201108-1kg6q7zsya/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments