MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc062275af294c93bf891da3aa1445bb52433632e83c97d152d05f0aa3466650. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 8


Intelligence 8 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc062275af294c93bf891da3aa1445bb52433632e83c97d152d05f0aa3466650
SHA3-384 hash: 070d77afd1eda81b0e20eebdd5a37b3850640e39162c468dc20b05811db9fd548eb4ffd2420c29de7300881a4581810c
SHA1 hash: 5c391622b2ff9a7c7ab688e49cd84312703f946c
MD5 hash: af29d0ec9f9cdd8a8ff0b8dfc3d010cd
humanhash: steak-six-may-alpha
File name:dc062275af294c93bf891da3aa1445bb52433632e83c97d152d05f0aa3466650
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'094'096 bytes
First seen:2020-11-15 09:55:21 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b8c436887f0ff05ef82a9442bb6ba7ca (3 x QuakBot)
ssdeep 12288:1qflDDoYel20NNHCizXv+Omjt7Wq2X6EQ2Xbhvs:100k0NNHCgCt7GNbRs
Threatray 1'451 similar samples on MalwareBazaar
TLSH 4735011BF2E35E9BD893447D59E284B98031EFADD31BE4732A48F5DA31F26C4822E505
Reporter JAMESWT_WT
Tags:Orangetree B.V. Qakbot Quakbot signed

Code Signing Certificate

Organisation:Orangetree B.V.
Issuer:Sectigo RSA Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:Nov 4 00:00:00 2020 GMT
Valid to:Nov 4 23:59:59 2021 GMT
Serial number: 7E0CCDA0EF37ACEF6C2EBE4538627E5C
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Thumbprint Algorithm:SHA256
Thumbprint: D032358A31097655857E002CE8EC0FA10DDA8E7569D97955CED1DACC7D79926A
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
196
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Packed.Jaik-9792690-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Sending a UDP request
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc062275af294c93bf891da3aa1445bb52433632e83c97d152d05f0aa3466650/
Threat name:
Win32.Trojan.QBot
Create hunting rule
Status:
Malicious
First seen:
2020-11-13 16:15:45 UTC
File Type:
PE (Exe)
AV detection:
28 of 29 (96.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3qdce5npffgjhp4jdwr2ufcfxnjegnrs5a6jpuks2bpqvi2gmzia._file
Verdict:
malicious
Similar samples:
12a59869c0e78eed60e76adc9c592ba8b9f3d2835f19d4c46e7a458739d6aedf
QuakBot
4e21f2eefe25c07034fe9a8dc009cf05b33fd4d94979200921cf61f6efd15654
QuakBot
5401646f0c0e59d051a7af22287139db248b5b95087c228a9e7380fcd6cedb75
QuakBot
6a25eecf4c09687ee9eb25089d656e75b86b83464b681f08d14d7cd9fa468a6d
QuakBot
a1093cae5947b010c760dc1e04d9ac932b45dfe46f67b38b8f5b37c807084261
QuakBot
a496166b093b8b09a59f952e7a9a2196aa7754dd3485b4412ec0334cd59714a3
QuakBot
b67267d494ea23d58a61c127eb8e32b274878c3dcfa6586e344604397f7a457b
QuakBot
cdd0849cc7c21652c39ffdbdc039bc211b2044003c97c6bd964fca15012bd4d5
QuakBot
d5f719a5fb651053def370762beb99e78cf222f02d57ddb185b574dfe91627dc
QuakBot
d63cdb3488f01ba3934ca197871561781f9c657bff81dc3192683d7a6c6e06d3
QuakBot
+ 1'441 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201115-zn45l75smx/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
dc062275af294c93bf891da3aa1445bb52433632e83c97d152d05f0aa3466650
MD5 hash:
af29d0ec9f9cdd8a8ff0b8dfc3d010cd
SHA1 hash:
5c391622b2ff9a7c7ab688e49cd84312703f946c
Link:
https://www.unpac.me/results/70cc59e2-e9b7-4620-8f4d-5546e7a5b0fd/
SH256 hash:
f22b7446378015d1b677cf9f10f89d5db07dabbf1029d1de281f28f187287dba
MD5 hash:
0640b3b6e2f61abb7a211d94384a4b40
SHA1 hash:
3fdcc7119fb07db6f4090d79df6fbda51c7b8bf1
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/70cc59e2-e9b7-4620-8f4d-5546e7a5b0fd/
SH256 hash:
4692f0a62f714d0acb7a58b0f52e96844d75e93980e87a3c959eb6773d734e0d
MD5 hash:
34b6b8e9f422bd64ddac18fb466cbdfa
SHA1 hash:
fb0f92fcab48eb274191d734fc557158c0ebc8df
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/70cc59e2-e9b7-4620-8f4d-5546e7a5b0fd/
Parent samples :
bec5a928b9c8302b548e7dc833fb81e0a257144872551644b0a140a54a98cfb5
4d71f075bea3a0676161c066ad62175bdf28655c7ef685192859b278e93c6a06
7bee1221cbd108696ffa02049448bf4a39894b742f6cba59bd67bc83863617b3
dc062275af294c93bf891da3aa1445bb52433632e83c97d152d05f0aa3466650
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments