MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e221d41c0509200b65f16de79d39584be8ae05440aacb4ac008da74d5f63d268. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e221d41c0509200b65f16de79d39584be8ae05440aacb4ac008da74d5f63d268
SHA3-384 hash: 84adede6e48332231c89370f069cd660cccede1487fc8c446266d81fe4500c47aecfb289b91b8165bdef76ced4e9dbde
SHA1 hash: 46942a5de17f5af858dd41a7ee81c7293d217b7b
MD5 hash: 9290bb9698f224b71444e817b200403d
humanhash: connecticut-oven-river-triple
File name:e221d41c0509200b65f16de79d39584be8ae05440aacb4ac008da74d5f63d268
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'084'416 bytes
First seen:2020-11-07 16:53:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c1e35a855d20d45e9c84f5bd029dd388 (154 x Quakbot)
ssdeep 6144:CUVqnVKGBCKIMRD83dZkFICdy2RsoNbDLyZ31EyIEgfdh0tjKkuGInR+HlZzmU6s:CNQACKtOzxn2RBZeKTUUhulLhJ9FCe
TLSH 433512D7F9BC8471CAED297F8993123C968A85E85D05D10B0778A5ADBDF3200FE9244B
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Deleting a recently created file
Creating a window
Forced shutdown of a system process
Enabling autorun by creating a file
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e221d41c0509200b65f16de79d39584be8ae05440aacb4ac008da74d5f63d268/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-07 16:55:32 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4iq5ihafbeqawzprnxtz2okyjpuk4bkebkwljlaarwtu2x3d2jua._file
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201108-6qasbfzf6s/
Behaviour
Runs ping.exe
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Checks SCSI registry key(s)
Qakbot/Qbot
Qakbot/Qbot
Unpacked files
SH256 hash:
e221d41c0509200b65f16de79d39584be8ae05440aacb4ac008da74d5f63d268
MD5 hash:
9290bb9698f224b71444e817b200403d
SHA1 hash:
46942a5de17f5af858dd41a7ee81c7293d217b7b
Link:
https://www.unpac.me/results/e7918dfb-d291-4231-8a33-dbb27a7057c4/
SH256 hash:
23fac952b401d2b903ebccd018339555ac003cbc3a602bf6a66856cfe48e5bf7
MD5 hash:
1d97e26a4949e802fd89ffcf2b9c8c25
SHA1 hash:
2fecd868301dc388739a880db4f5895ef1461ace
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/e7918dfb-d291-4231-8a33-dbb27a7057c4/
Parent samples :
e221d41c0509200b65f16de79d39584be8ae05440aacb4ac008da74d5f63d268
827db42a714ce9009c887b8363f4c537a08bb6cdc3b20186c8d1eff604e955ec
a5345cb20dbe087faafdda55d9abf2acb54168524b2d5ab635718e2a6032b47e
cec7871489e459188db78ecc641dfc0cfd9ae7e3ad20daa21395e73ede22e490
1750f06e4ff7e39260edb619e43bc8bf4e349399d841c450391bb571aec04ec1
b8649d3f9fce789feb20de3c8d0c49d23877f77aa6fb4ec2d0e8a92bcf978548
SH256 hash:
6227850105adf574fe07d65bd39fabaca91574cac48304248c9140eb78726e62
MD5 hash:
b9761d7d43c24a493f87df31aca1b102
SHA1 hash:
899f7e462e80127e679710bbb98dfce3cfe42b9d
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/e7918dfb-d291-4231-8a33-dbb27a7057c4/
Parent samples :
73d8eec4558786e302ac9d8d4252a60eebdf4f66eec9925b58d437dbaa5d826e
e221d41c0509200b65f16de79d39584be8ae05440aacb4ac008da74d5f63d268
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments