MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2d5f4c171dc88b453be93a2b940a815143657952863fe6daf32bdd01ed1577d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e2d5f4c171dc88b453be93a2b940a815143657952863fe6daf32bdd01ed1577d
SHA3-384 hash: d70ddaa223a99823095093a84976fa58a69fc4f2ec8a3064e74a44a2d3e910bfb593ad33d9bc70fc69f2eda7085e9d18
SHA1 hash: 1c70964f7fe6193c069f450e745091cccf372f5a
MD5 hash: e048555d9a560d76bba55795699ba507
humanhash: moon-neptune-east-beryllium
File name:SecuriteInfo.com.Trojan.QakBot.11.13046.22224
Download: download sample
Signature QuakBot
Create hunting rule
File size:959'480 bytes
First seen:2020-10-10 10:38:32 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 26a69d12ffc2f1bc1c4a71f01c654d31 (7 x QuakBot)
ssdeep 6144:Mv4Jb6PYNgiQsyaxAUyetu9ITzmXG33wXd5FLY9C3DzkgJkw20v:MgWPYe4ueQ9ITz8GnwXbFsWDzl+0v
Threatray 588 similar samples on MalwareBazaar
TLSH 4815E001FD78DD06D2A52D7C4E2617B89E8B78C4EC13605376AA5F2CBCF63A29C5E405
Reporter SecuriteInfoCom
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
169
Origin country :
n/a
Vendor Threat Intelligence
Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Sending a UDP request
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Launching a process
Creating a window
Unauthorized injection to a system process
Enabling autorun by creating a file
Result
Threat name:
Qbot
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/487490
Signature
Antivirus / Scanner detection for submitted sample
Binary contains a suspicious time stamp
Contains functionality to compare user and computer (likely to detect sandboxes)
Contains functionality to detect virtual machines (IN, VMware)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Machine Learning detection for sample
Sigma detected: QBot Process Creation
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Qbot
Behaviour
Behavior Graph:
Download SVG
Detection:
qakbot
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e2d5f4c171dc88b453be93a2b940a815143657952863fe6daf32bdd01ed1577d/
Threat name:
Win32.Trojan.QBot
Create hunting rule
Status:
Malicious
First seen:
2020-10-10 10:40:06 UTC
AV detection:
25 of 29 (86.21%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=4lk7jqlr3seliu56sorlsqficukdmv4vfbr743npgk65ahwrk56q._file
Verdict:
malicious
Similar samples:
0652d513a2c43aaabbb806eeda3e035aa3b12449a718610d42453896d9f97751
QuakBot
45bd22771aeaab651a6ff5a3a23193446ffd305472082d06ad6612878fa2786e
QuakBot
70c7a48f3dfb41c0137b736bf5f3071bfd550eb8dee8fc6b3c5a075adbecbdbb
QuakBot
92459aab5fc4c348f5a6a10fa7ce8bc734121a8e2d8d3c30e4337f74ae87017a
QuakBot
9adfaa5b63a6a5456740d383e463055f47b796114675f0912e185638ad135d4a
QuakBot
b78c608b6efdbcab010375b990d029eefd2aa139b5796cd5b10adf50a8e48ec3
QuakBot
b92c0aafb4e9b0fc2b023dbb14d7e848249f29e02b0e4cd8624ce27e55c9ac4c
QuakBot
bfb48416b0557ef0d47177d809287384f47d0bf985504ee9b243d7161293364e
QuakBot
c118e4088bc5aaffebe7208df9f01da9d70ba625ba020c593723495c0954a203
QuakBot
e6e67623e24b8c95021d63966ac7f2ba20e7fbe9495b32290871fc9fa8fe4fe3
QuakBot
+ 578 additional samples on MalwareBazaar
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
trojan banker stealer family:qakbot
Link:
https://tria.ge/reports/201010-8sfhyabbfj/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
a29448ae480bc46253bd3c0d9c2467dd041cefd456bb5a7ec8f98c40c73451bc
MD5 hash:
acf407ae776dfb1332ea31bbbcc52bd0
SHA1 hash:
731176cbd6e6845081c9ed4bc039caf6b2e1bb49
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/7eba2aaf-811c-4224-a3d0-1552515dfe3b/
Parent samples :
bfb48416b0557ef0d47177d809287384f47d0bf985504ee9b243d7161293364e
e2d5f4c171dc88b453be93a2b940a815143657952863fe6daf32bdd01ed1577d
c537e20b181e0bd13cc919d2decb053e56aad510f0c4011d10454ce8a2339037
93062f1a1c0b4b04c62355d3ee310dcaacb301cd1980ce9ebef89fb3963a40ef
58228a52b83bbd17d6ac52cd52767ebfe01327787b218f9c41ad66c1702bb62b
85753f341c17caad8c49790a7b6beb6ddca9f6106c54ece912203e77baa9aa09
SH256 hash:
292b0d219b511a2e19ac50a8aafd4cfd353b29c1003000529525387fa63cdde2
MD5 hash:
e18cadd77b980bb41129c3684de3b7c7
SHA1 hash:
e1e60ee8a91371ca47e096d83a2f715963c1f214
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/7eba2aaf-811c-4224-a3d0-1552515dfe3b/
SH256 hash:
e2d5f4c171dc88b453be93a2b940a815143657952863fe6daf32bdd01ed1577d
MD5 hash:
e048555d9a560d76bba55795699ba507
SHA1 hash:
1c70964f7fe6193c069f450e745091cccf372f5a
Link:
https://www.unpac.me/results/7eba2aaf-811c-4224-a3d0-1552515dfe3b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e2d5f4c171dc88b453be93a2b940a815143657952863fe6daf32bdd01ed1577d

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

QuakBot

Executable exe e2d5f4c171dc88b453be93a2b940a815143657952863fe6daf32bdd01ed1577d

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/69743/
  
URLhaus
https://urlhaus.abuse.ch/url/678798/
  
Delivery method
Distributed via web download

Comments