MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8be99a67635ce711c3d165e4e5ad8aad798bc398c92f8be924b5dec534063f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8be99a67635ce711c3d165e4e5ad8aad798bc398c92f8be924b5dec534063f0
SHA3-384 hash: c5f944db5dc8620359221f89e0da80215f9a28a2446341dc18b5088982d472177d1c64ee4a2a0bd769e2f8b2ec6bd54c
SHA1 hash: 464b99bc1ba03a46aa9a9441507deddcfaea1067
MD5 hash: c0d3064419576dd51867789f338905f5
humanhash: orange-avocado-montana-uranus
File name:d8be99a67635ce711c3d165e4e5ad8aad798bc398c92f8be924b5dec534063f0
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'084'416 bytes
First seen:2020-11-14 18:24:59 UTC
Last seen:2020-11-14 19:42:30 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c1e35a855d20d45e9c84f5bd029dd388 (154 x Quakbot)
ssdeep 6144:uRxiDd759cI4RD83dTkFICdy2Ms9NbD0qZ31EyqEgfl30tjKkUGInR+HlZzmP6Mh:uR89cJOJxn2MdBeKxPUhulLhJ9FCe
Threatray 1'447 similar samples on MalwareBazaar
TLSH 653522D7F9BC8471CAED297F8993123C968A85E85D05D10B0778A5ADBDF3200FE9244B
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
68
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.KillProc2.14335.20916.4200.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Sending a UDP request
Creating a window
Forced shutdown of a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8be99a67635ce711c3d165e4e5ad8aad798bc398c92f8be924b5dec534063f0/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-14 18:29:31 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3c7jtjtwgxhhchb5czpe4wwyvllzrpbzrsjprpusjno6yu2ampya._file
Verdict:
malicious
Similar samples:
063e0c71b3ede4a7d8a8cd1d1e35432b2e3ce0bf1dfd58c266e93ea91b8895fa
QuakBot
12a33b4cbaa8523b49fbf03ce5ac773e1846660662a0ca67b7dae618606e6ae4
QuakBot
18a52a088f46ae8a4dbfc27760bdb3e22dda61ed353c8b8ff3dc16aaa1df4c43
QuakBot
24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643
QuakBot
36f09e30f8b3f4efe845d4e344e847219c9c62a7fa9a61c2d8d70969d19726ec
QuakBot
63e634708c32b76a6f40c0ccb0b8fb59ecb4e42cbe1f89a2fa56ab41f16fa433
QuakBot
7e0e9f3a1f1bae034cd67784a804dd40375c5b738f7083c9e337197a296425ef
QuakBot
a401e9208a31cca327a31ee872a258b358dbd276304625e461d46f5c656d5723
QuakBot
b644206586b6aa00d023a65da373503824e68a032890d4ca99f8532257d07dc1
QuakBot
d25368643d599cbdf56c6eb579505b3f21e4b00c8f1c8243cb18040c66751a3b
QuakBot
+ 1'437 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201114-ztl6j2qanx/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
d8be99a67635ce711c3d165e4e5ad8aad798bc398c92f8be924b5dec534063f0
MD5 hash:
c0d3064419576dd51867789f338905f5
SHA1 hash:
464b99bc1ba03a46aa9a9441507deddcfaea1067
Link:
https://www.unpac.me/results/f094a8a8-1d3e-4962-bcb7-979ed0c3d862/
SH256 hash:
78c5a96607a03a1307a29c9489e49ac5910ca6edd605d4efce226a54ea87b76e
MD5 hash:
edb8a157a75736acffd86fe6a057b433
SHA1 hash:
ffaba2d93b5367957367681b7a276dac1406f0de
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/f094a8a8-1d3e-4962-bcb7-979ed0c3d862/
Parent samples :
4f1566795077320406ae3ded8622923036b8531c9cde840a6540c66a366505dd
ac7368bd75142d7c2c0990811ddcf4962ac5c6fc42c3a4b6846dfd80423c2750
24f828742baaedb176d3dba0bdf3d06682c174a9b46b35bf5d145ee57f2aa643
77e8872e2c9a68dceed90a1e59d2805019963759747a1134be407f5bc14ce28b
58593fd5fb90f5fd420e3dcf0ed7e1fb5fcb5a3ac89acf685acc7d4c0e7df9ff
bf2e0f665eac44398fdeb7e3dc2451a9230686f6b8f0b18bb656d6a1bc8aad4e
d8be99a67635ce711c3d165e4e5ad8aad798bc398c92f8be924b5dec534063f0
54a201fb84a5b1c713037f0d687812aa96cd9029c933d9c316c1f035a9b3597e
SH256 hash:
321a8785a4ff7593ef0a8e85fb45874f691fb53d3fb6d083ab7951134f2a71fa
MD5 hash:
1275bbd597606a2ed65e70cff8684fa9
SHA1 hash:
115eb326e2810c9cb69422d283fd6003f49507c7
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/f094a8a8-1d3e-4962-bcb7-979ed0c3d862/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d8be99a67635ce711c3d165e4e5ad8aad798bc398c92f8be924b5dec534063f0

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments