MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 197a647befe1a116092e9b3925fd83d41d960086395d60f71d68302e2c6cda45. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	197a647befe1a116092e9b3925fd83d41d960086395d60f71d68302e2c6cda45
SHA3-384 hash:	5eb1b8659167df369bd21d52cfad236600657fea05e7d1e2e181ccd40fc78b0374e42df845630cd9f3b722c88a0c1d11
SHA1 hash:	f6d0c34bb4e98660207c5720ba68be0b7fd95540
MD5 hash:	06199dd9dd5a58456563f12eb82eb6f5
humanhash:	sierra-artist-zebra-purple
File name:	06199dd9dd5a58456563f12eb82eb6f5.dll
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	1'366'677 bytes
First seen:	2021-02-27 06:51:54 UTC
Last seen:	2021-02-27 09:04:20 UTC
File type:	dll
MIME type:	application/x-dosexec
imphash	fd437c155e766d9c7ab04f8c3b66ef71 (5 x Quakbot)
ssdeep	24576:Mm4KIe7WgCBxOQyvlHxhXjqpdwWow1Rht956wCLVAWRCySnAZWt:14GQ9yvlHCdwSZT56wCL1bSnN
Threatray	1'421 similar samples on MalwareBazaar
TLSH	DE55336D2367DCBACD19AFBD230B039F1308916F44318E3C56CF71A4862659FA792B58
Reporter	abuse_ch
Tags:	dll Qakbot qbot Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

371

Origin country :

n/a

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/119577/

Detection(s):

SecuriteInfo.com.W32.AIDetect.malware2.31600.1714.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a UDP request

Creating a window

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/197a647befe1a116092e9b3925fd83d41d960086395d60f71d68302e2c6cda45/

Threat name:

Win32.Trojan.QBot

Status:

Malicious

First seen:

2021-02-27 06:52:08 UTC

AV detection:

17 of 48 (35.42%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=df5gi67p4gqrmcjotm4sl7md2qozmaeghfowb5y5nayc4ldm3jcq._file

Verdict:

malicious

Result

Malware family:

n/a

Score:

7/10

Tags:

themida

Link:

https://tria.ge/reports/210227-abyzaajqme/

Behaviour

Suspicious use of WriteProcessMemory

Unpacked files

SH256 hash:

197a647befe1a116092e9b3925fd83d41d960086395d60f71d68302e2c6cda45

MD5 hash:

06199dd9dd5a58456563f12eb82eb6f5

SHA1 hash:

f6d0c34bb4e98660207c5720ba68be0b7fd95540

Link:

https://www.unpac.me/results/385cc2eb-27ae-466a-9e00-a1f1a539e71d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/197a647befe1a116092e9b3925fd83d41d960086395d60f71d68302e2c6cda45

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.