Static task
static1
Behavioral task
behavioral1
Sample
Trojan-Banker.Win32.Qbot.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Trojan-Banker.Win32.Qbot.dll
Resource
win10v2004-20240226-en
General
-
Target
Trojan-Banker.Win32.Qbot.amav-03ee6c8f63b7fe5c1bf9aa22893a70f0c4e31327b5bc676e1ce8047160b90220
-
Size
612KB
-
MD5
1b2d578f0b416afd9a6d8ea6117ec9c7
-
SHA1
7d56f6300fe6fed212d3d0d93b69f9c0b92a9ffc
-
SHA256
03ee6c8f63b7fe5c1bf9aa22893a70f0c4e31327b5bc676e1ce8047160b90220
-
SHA512
f3a821197827583db15e7eed80d5cc603003aff8f10618ab208b391be6b1235cebd1181ebd01b15afacd59fa308dd4ad551463f20cca0e52f08bb4161cfddc70
-
SSDEEP
6144:1pUwN0IMoNmL7x4SVbBSabPTeboxqoTkEaWraN4paWTvdWKSfU+eh:oUFNmLKSV1JbPT+4xrnSA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Trojan-Banker.Win32.Qbot.amav-03ee6c8f63b7fe5c1bf9aa22893a70f0c4e31327b5bc676e1ce8047160b90220
Files
-
Trojan-Banker.Win32.Qbot.amav-03ee6c8f63b7fe5c1bf9aa22893a70f0c4e31327b5bc676e1ce8047160b90220.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.codes Size: 311KB - Virtual size: 310KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdatau Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ