MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19ff7eb3e2f7eef435ef2ed4b2c5a45dcd3ae218ae7b1f52b528a0c7d383ce6b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 19ff7eb3e2f7eef435ef2ed4b2c5a45dcd3ae218ae7b1f52b528a0c7d383ce6b
SHA3-384 hash: 94f45c17b6422f1e11cc7d7bf4b81b7ada684e34e643371e7715b07c82e41efe9ddd0b1119ed65229760ef696ee9218e
SHA1 hash: c0432d1247c1389b963f3897d4a4e11f8c578d69
MD5 hash: ee5582dd68674703570246d4511a410a
humanhash: ceiling-pennsylvania-muppet-avocado
File name:Teentruebaaet3437031160.zip
Download: download sample
Signature Quakbot
Create hunting rule
File size:380'580 bytes
First seen:2022-10-20 16:05:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: NH833
ssdeep 6144:OJygnuCBJpYP5QAKKdhds0TIBr/i9DhdYJgAcyFFdjaTXkCoQsKGa7i44tzs2FMU:OJ9uue5dm0Wri/WbJaj1Epa7P4tzr
TLSH T1078423410810B887A5CA541B988E95F693115EAF0208CBD7E6EF84727DB37CF8D68F67
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter pr0xylife
Tags:BB04 pw NH833 Qakbot Quakbot zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
204
Origin country :
n/a
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:musquash.cmd
File size:496 bytes
SHA256 hash: 08701362096b1a7ea499e954595a288222ffe8444755347ee248d524366bf1dd
MD5 hash: bc4a5b233e21e90cb1296bb2b2e78457
MIME type:text/x-msdos-batch
Signature Quakbot
File name:grazed.ssd
File size:650'752 bytes
SHA256 hash: 9ffd782dc0ff611a67170546287213e7ff90f9eff32faa573493c0b1d28b980b
MD5 hash: b8fbd8b16ad9ff30ceb83a845ef9c413
MIME type:application/x-dosexec
Signature Quakbot
File name:Contract.lnk
File size:1'805 bytes
SHA256 hash: e6bc00ef3ca76b921a5b8c62c928ee7b93f0b1f76fa9adf73c3c1e256c57ce82
MD5 hash: bbef5c10184cef14f2be43c15421c905
MIME type:application/octet-stream
Signature Quakbot
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.62970465.1137.29630.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/19ff7eb3e2f7eef435ef2ed4b2c5a45dcd3ae218ae7b1f52b528a0c7d383ce6b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/19ff7eb3e2f7eef435ef2ed4b2c5a45dcd3ae218ae7b1f52b528a0c7d383ce6b/
Threat name:
Binary.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-10-21 04:08:22 UTC
File Type:
Binary (Archive)
AV detection:
3 of 42 (7.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dh7x5m7c67xpinppf3klfrnelxgtvyqyvz5r6uvvfcqmpu4dzzvq._file
Gathering data
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/19ff7eb3e2f7eef435ef2ed4b2c5a45dcd3ae218ae7b1f52b528a0c7d383ce6b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PassProtected_ZIP_ISO_file
Create hunting rule
Author:_jc
Description:Detects container formats commonly smuggled through password-protected zips

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

zip 19ff7eb3e2f7eef435ef2ed4b2c5a45dcd3ae218ae7b1f52b528a0c7d383ce6b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2380747/
  
Delivery method
Distributed via web download

Comments