2021-09-27 19:30:19
7b3bf330d8b8bdc633b50cd4fbfebe95
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .text | 0x00001000 | 0x00016718 | 0x00016800 | 6.63166798693 |
| .rdata | 0x00018000 | 0x000047d8 | 0x00004800 | 6.99363470745 |
| .data | 0x0001d000 | 0x00001790 | 0x00001800 | 7.7276025971 |
| .rsrc | 0x0001f000 | 0x000004f8 | 0x00000600 | 7.27848574452 |
| .reloc | 0x00020000 | 0x00000c08 | 0x00000e00 | 6.21409848529 |
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_RCDATA | 0x0001f4cc | 0x00000029 | LANG_NEUTRAL | SUBLANG_NEUTRAL | data |
| RT_RCDATA | 0x0001f4cc | 0x00000029 | LANG_NEUTRAL | SUBLANG_NEUTRAL | data |
| Ordinal | Address | Name |
|---|---|---|
| 1 | 0x6d515e77 | DllRegisterServer |
| Antivirus | Signature |
|---|---|
| Bkav | W32.AIDetectMalware |
| Lionic | Trojan.Win32.Qbot.11!c |
| Elastic | Windows.Trojan.Qbot |
| ClamAV | Win.Keylogger.Qakbot-9916943-1 |
| CMC | Clean |
| CAT-QuickHeal | Trojan.Ghanarava.1713912989f2da90 |
| Skyhigh | BehavesLike.Win32.Dropper.ch |
| ALYac | Gen:Variant.Razy.950267 |
| Cylance | Unsafe |
| Zillya | Trojan.Qbot.Win32.14044 |
| Sangfor | Banker.Win32.Qbot.Vq28 |
| CrowdStrike | win/malicious_confidence_100% (W) |
| Alibaba | TrojanBanker:Win32/Qakbot.7c262761 |
| K7GW | Riskware ( 0040eff71 ) |
| K7AntiVirus | Riskware ( 0040eff71 ) |
| Baidu | Clean |
| VirIT | Clean |
| Paloalto | generic.ml |
| Symantec | ML.Attribute.HighConfidence |
| tehtris | Clean |
| ESET-NOD32 | a variant of Win32/Qbot.DM |
| APEX | Malicious |
| Avast | Win32:BankerX-gen [Trj] |
| Cynet | Malicious (score: 100) |
| Kaspersky | Trojan-Banker.Win32.Qbot.acpa |
| BitDefender | Gen:Variant.Razy.950267 |
| NANO-Antivirus | Clean |
| ViRobot | Clean |
| MicroWorld-eScan | Gen:Variant.Razy.950267 |
| Tencent | Win32.Trojan-Banker.Qbot.Qqil |
| Sophos | Troj/Qbot-IB |
| F-Secure | Heuristic.HEUR/AGEN.1302363 |
| DrWeb | Clean |
| VIPRE | Gen:Variant.Razy.950267 |
| TrendMicro | Clean |
| McAfeeD | ti!78ECEB27A491 |
| Trapmine | malicious.high.ml.score |
| CTX | dll.unknown.razy |
| Emsisoft | Gen:Variant.Razy.950267 (B) |
| huorong | Trojan/Injector.ahv |
| FireEye | Generic.mg.32d985df8494a57c |
| Jiangmin | Clean |
| Webroot | Clean |
| Varist | W32/Qbot.GD.gen!Eldorado |
| Avira | HEUR/AGEN.1302363 |
| Fortinet | W32/Qbot.DK!tr |
| Antiy-AVL | Trojan/Win32.Qbot |
| Kingsoft | malware.kb.a.777 |
| Gridinsoft | Clean |
| Xcitium | Clean |
| Arcabit | Trojan.Razy.DE7FFB |
| SUPERAntiSpyware | Clean |
| Microsoft | Trojan:Win32/Qakbot.AD!MTB |
| Detected | |
| AhnLab-V3 | Trojan/Win.QakBot.C4634013 |
| Acronis | Clean |
| McAfee | Trojan-FTYB!32D985DF8494 |
| TACHYON | Clean |
| VBA32 | Trojan.LE.0719 |
| Malwarebytes | Backdoor.Qbot |
| Panda | Trj/GdSda.A |
| Zoner | Clean |
| TrendMicro-HouseCall | Clean |
| Rising | Backdoor.Qakbot!1.F0E4 (CLASSIC) |
| Yandex | Trojan.PWS.Qbot!zswdJ58p4fg |
| SentinelOne | Static AI - Suspicious PE |
| MaxSecure | Trojan.Malware.192226519.susgen |
| GData | Gen:Variant.Razy.950267 |
| AVG | Win32:BankerX-gen [Trj] |
| DeepInstinct | MALICIOUS |
| alibabacloud | Trojan[spy]:Win/Banker.JTH |
| IRMA | Signature |
|---|---|
| ESET Security (Windows) | a variant of Win32/Qbot.DM trojan |
| Avast Core Security (Linux) | Win32:BankerX-gen [Trj] |
| C4S ClamAV (Linux) | Win.Keylogger.Qakbot-9916943-1 |
| F-Secure Antivirus (Linux) | Heuristic.HEUR/AGEN.1302363 [Aquarius] |
| McAfee CLI scanner (Linux) | Trojan-FTYB |
| Bitdefender Antivirus (Linux) | Gen:Variant.Razy.950267 |
| G Data Antivirus (Windows) | Virus: Gen:Variant.Razy.950267 (Engine A) |
| Sophos Anti-Virus (Linux) | Troj/Qbot-IB |
| DrWeb Antivirus (Linux) | Clean |
| Trend Micro SProtect (Linux) | Clean |
| ClamAV (Linux) | Win.Keylogger.Qakbot-9916943-1 |
| eScan Antivirus (Linux) | Gen:Variant.Razy.950267(DB) |
| Kaspersky Standard (Windows) | UDS:Trojan-Banker.Win32.Qbot.acpa |
| Emsisoft Commandline Scanner (Windows) | Gen:Variant.Razy.950267 (B) |