MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eac1e941a91302d5c86113d2e7744a3551759a9846a69ca1e939bab345f3f08e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


QuakBot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eac1e941a91302d5c86113d2e7744a3551759a9846a69ca1e939bab345f3f08e
SHA3-384 hash: 54b933831754151c71eaa548b838ab212b140b1ccc06fedbc97ea347ceacfc1632e9061040af862255ddcd7d4cfb4f1e
SHA1 hash: 219b9aea62ed55ec3ad05123867f864ca77b8f23
MD5 hash: e9badc9404804e56635bbef57f9a1715
humanhash: video-mars-xray-bakerloo
File name:255600428f93f830b9fe602a363d9f7e
Download: download sample
Signature QuakBot
Create hunting rule
File size:1'094'120 bytes
First seen:2020-11-17 12:04:06 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash ba5c263c6125faae2c597950f7826711 (27 x Quakbot)
ssdeep 12288:OqflDDoYwr6cNNHCW8k45hox9l7pUH5X6EQ2Xbhx:O0KGcNNHCWZmO7aH1Nbv
TLSH E035011BE1E35BCBE483817C59E280BA9532EF8DDB5BD47B2A18F0D871B63C5811E604
Reporter seifreed
Tags:Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a process with a hidden window
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
Running batch commands
Launching a process
Modifying an executable file
Delayed writing of the file
Result
Verdict:
0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eac1e941a91302d5c86113d2e7744a3551759a9846a69ca1e939bab345f3f08e/
Threat name:
Win32.Trojan.PinkSbot
Create hunting rule
Status:
Malicious
First seen:
2020-11-17 12:06:52 UTC
AV detection:
26 of 29 (89.66%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=5la6sqnjcmbnlsdbcpjoo5ckgvixlguyi2tjzipjhg5lgrpt6cha._file
Verdict:
malicious
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/201117-cjfwlgw83e/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Checks SCSI registry key(s)
Qakbot/Qbot
Unpacked files
SH256 hash:
eac1e941a91302d5c86113d2e7744a3551759a9846a69ca1e939bab345f3f08e
MD5 hash:
e9badc9404804e56635bbef57f9a1715
SHA1 hash:
219b9aea62ed55ec3ad05123867f864ca77b8f23
Link:
https://www.unpac.me/results/3868950d-3de5-4e1a-93c7-09813e19bd12/
SH256 hash:
68a0bf16e7d1d4cb6015de5f09171af4a8252950ccc348ba1a64fe21360ff5e3
MD5 hash:
41a0b9f3747210f83b88f21a850f4f89
SHA1 hash:
06ae4a0ba2a332e1af580132ea25ae6c6f67882a
Detections:
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/3868950d-3de5-4e1a-93c7-09813e19bd12/
SH256 hash:
90fd0ec9eab4f5ed45530803cfb4396e14aec37e025e05a227da63c1791b4d4e
MD5 hash:
0da7bad19e1b63ab85c297dc63560bf5
SHA1 hash:
0bd13e346431bf6006722f5913371228c3251c0e
Detections:
win_qakbot_g0
Create hunting rule
win_qakbot_auto
Create hunting rule
Link:
https://www.unpac.me/results/3868950d-3de5-4e1a-93c7-09813e19bd12/
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments