MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc2cadf4c6d232808dcac24ea4afb4d482c0c3e951bea9894a7de2b35553c429. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc2cadf4c6d232808dcac24ea4afb4d482c0c3e951bea9894a7de2b35553c429
SHA3-384 hash: 322d5275e225a31c49e1cb2813821b18aff268d11d4c69bf2aa24cb2d7e3117c28f38c4060835004e1bd938986bee662
SHA1 hash: 34f93d66ababb7f93c5885cb87391cbbdd1dc8ed
MD5 hash: 3fc1192237e078f20e81214ffb2bba28
humanhash: carbon-nuts-oregon-mississippi
File name:191a6667728a0d197e4d864eabc25742
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'094'120 bytes
First seen:2020-11-17 12:22:01 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ba5c263c6125faae2c597950f7826711 (27 x Quakbot)
ssdeep 12288:aqflDFoKNF6cNNHCW8k45hox9l7pUHaX6EQ2Xbh9:a0nEcNNHCWZmO7aHwNbb
TLSH BC35011BE1E35BCBE483817C59E280BA9532EF8DDB5BD47B2A18F0D871B63C5851E604
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Running batch commands
Launching a process
Modifying an executable file
Delayed writing of the file
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc2cadf4c6d232808dcac24ea4afb4d482c0c3e951bea9894a7de2b35553c429/
Threat name:
Win32.Trojan.PinkSbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:25:18 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zqwk35gg2izibdokyjhkjl5u2sbmbq7jkg7ktckkpxrlgvktyquq._file
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201117-859797tpfj/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
cc2cadf4c6d232808dcac24ea4afb4d482c0c3e951bea9894a7de2b35553c429
MD5 hash:
3fc1192237e078f20e81214ffb2bba28
SHA1 hash:
34f93d66ababb7f93c5885cb87391cbbdd1dc8ed
Link:
https://www.unpac.me/results/b6908486-7573-44d5-a505-f452170afb1e/
SH256 hash:
b70de9d1ca675a554b9baa20a059d6e5f035a58723b9ba259247236a379a14b5
MD5 hash:
830cb637dab9b28085c41c718f7cdd3e
SHA1 hash:
93ea1769ac375e2a40a005a1976802cd84a4f98c
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/b6908486-7573-44d5-a505-f452170afb1e/
Parent samples :
cb328d1a8558878187bbfb7f03629273695fbdd2711aa64a65da8a419b0ed457
cc2cadf4c6d232808dcac24ea4afb4d482c0c3e951bea9894a7de2b35553c429
eddbd95e74a6d5f4afce54bc50a4eeb5767a70b2f3e88f2f2f4e8730745c2699
SH256 hash:
9d0c91bcf4d66f84e95ab924770abfb1cc55b3127953057e397c2af9102ee569
MD5 hash:
45218c6ada2b05ff332599d6042b5178
SHA1 hash:
af231224cc176c22271d590d7455f6374f5f8ebe
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/b6908486-7573-44d5-a505-f452170afb1e/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments