MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ccc14f2bab2e9eb1d7228e225afda558fd4b52ed670303a912ace1984b35b06. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2ccc14f2bab2e9eb1d7228e225afda558fd4b52ed670303a912ace1984b35b06
SHA3-384 hash: fa3b0fb1b5f1d89881ea2f60ba917fb1cde4fa0f237a6b7f9e4c3b808039a1c7a23571c5d4ced29febee33abed7d32d0
SHA1 hash: a515688ce5655db73a164bf471d5c92e75a4e0a7
MD5 hash: 7e233554c276988f2bde5c6d52ee180e
humanhash: aspen-nuts-juliet-apart
File name:Document_1204350147-Copy.zip
Download: download sample
Signature Quakbot
Create hunting rule
File size:19'608 bytes
First seen:2020-12-09 01:25:52 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 384:YUIvA/hGRHluFOE0j5whk6Lxaws4FWx7NW01sQ3rckYHqDdlnTt0bru:gvs8hE0q26e37gsvcEDR0fu
TLSH C292C070B2D6B215C623B7390E0E4526D0C6D5CDCAB4E387A191EBDFBDD5126A2302F2
Reporter malware_traffic
Tags:Qakbot qbot xls zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
317
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Heur.15645.29244.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.DLLREGISTERSERVER.200327.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.AOEX4.BITSNEEDEDFOR.DLLREGISTERSERVER.200416.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.Excel4Macro.HiddenSheetDLWAKEUP.20200310.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.HiddenSheetExcel4LureRecognizer.20200915.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.QakbotTheDuck.20200928.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.Excel4MagicPalmersArcade.20201207.UNOFFICIAL
Create hunting rule

Result
Verdict:
MALICIOUS
Details
Autostarting Excel Macro Sheet
Excel contains Macrosheet logic that will trigger automatically upon document open.
Document With Minimal Content
Document contains less than 1 kilobyte of semantic information.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2ccc14f2bab2e9eb1d7228e225afda558fd4b52ed670303a912ace1984b35b06/
Threat name:
Document-Office.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2020-12-09 01:11:12 UTC
AV detection:
7 of 48 (14.58%)
Threat level:
  5/5
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Trojan
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2ccc14f2bab2e9eb1d7228e225afda558fd4b52ed670303a912ace1984b35b06

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments