MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4d9bc5f48e3b718c1e1c9845e9a4ae1f70f4f4d94abed767bf4c314d0f2c0a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4d9bc5f48e3b718c1e1c9845e9a4ae1f70f4f4d94abed767bf4c314d0f2c0a4
SHA3-384 hash: da1b8355cdc268b6478154e9ff6532743d7ba817c47b6740b15d5f1f4aec0cd4797b4df93d6afa9cdb7c9ecd3f2b2c7f
SHA1 hash: 3ca2e33f961255f444a5ec3a83bb59100ce63bb6
MD5 hash: abe28f00c672bdc6d6227e00a02ce3b7
humanhash: vegan-alanine-hot-california
File name:5fcd0bd874ac7da0f10a4691ea261b2a
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'093'096 bytes
First seen:2020-11-17 11:22:38 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 3cff6a264a1d694a36fac2c685f6a919 (9 x QuakBot)
ssdeep 12288:BqflDFoQwFc0NNHCW8k45hox9l7pUH5X6EQ2XbhL:B0AG0NNHCWZmO7aH1NbV
Threatray 2'447 similar samples on MalwareBazaar
TLSH EF35011BE1E35BCBE493807C69E2917AD532EF8DDB1BD47B2A18F09871B23C5891E504
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4d9bc5f48e3b718c1e1c9845e9a4ae1f70f4f4d94abed767bf4c314d0f2c0a4/
Threat name:
Win32.Trojan.PinkSbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 11:23:22 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2tm3yx2i4o3rrqpbzgcf5gsk4h3q6t2nssv625t36tbrjuhsycsa._file
Verdict:
malicious
Similar samples:
158db3bfff1c49e646166f79b91e7aa18a96f3919561b2ffc1b7613a6845a449
QuakBot
320516fbe5067baaf86036ec770f5bc0eb7c667c13da29cacb2e428a9bd199f6
QuakBot
430ea9414b34feb3b1f55c0d873e77513181476b3738b34ce4a3bb4ec464aab9
QuakBot
5c6f9bba14dfb1e7b6a8dd697ae6ba69181d5af7cccf6dd40b89516d5ea483c3
QuakBot
7bee1221cbd108696ffa02049448bf4a39894b742f6cba59bd67bc83863617b3
QuakBot
9003653bd1f19432eb423ccf719c2de2189663b4240704d9eef95144945b348f
QuakBot
b62204e7ac2de6eb620fc2849593ab3bf50132836a5b648d572fd728c2404e72
QuakBot
bec5a928b9c8302b548e7dc833fb81e0a257144872551644b0a140a54a98cfb5
QuakBot
dc062275af294c93bf891da3aa1445bb52433632e83c97d152d05f0aa3466650
QuakBot
eb9915d87fd32bf37ff5e764a80b6fb4957598433774ae9fed10f82d932dba0c
QuakBot
+ 2'437 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201117-c3kfgh8fma/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
4d83173a81b9eedeab641f5cff5aef998fdb23b6d507613a66b9ef74dc511939
MD5 hash:
b5ba19044eb3bdd1275c7382bcffcc7b
SHA1 hash:
7547c505cfec88eb470c1b24d4e58d57ddaa0ace
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/0bf2165b-f697-446d-b805-9a668b944852/
SH256 hash:
8f3d5801ea9c83140b4bdf4b38b5ad02bcff9251624b0e33f88b7887f0e1faf0
MD5 hash:
ee0aac27bad677f433e5c799a51ea805
SHA1 hash:
8443ce1da497e251b4ed6c18534639f61d9c0093
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/0bf2165b-f697-446d-b805-9a668b944852/
SH256 hash:
d4d9bc5f48e3b718c1e1c9845e9a4ae1f70f4f4d94abed767bf4c314d0f2c0a4
MD5 hash:
abe28f00c672bdc6d6227e00a02ce3b7
SHA1 hash:
3ca2e33f961255f444a5ec3a83bb59100ce63bb6
Link:
https://www.unpac.me/results/0bf2165b-f697-446d-b805-9a668b944852/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments