MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5578fbc2b70fb9c4a49bfb8b7b6fbe945febee193699fcc9c2aa46675d86f778. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 4


Intelligence 4 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5578fbc2b70fb9c4a49bfb8b7b6fbe945febee193699fcc9c2aa46675d86f778
SHA3-384 hash: cc9e58984808bd7b3054d1107fc62f9e0c1dd6a1221476f56d99766b8d5242a99471e0912ac164945e57ceae73448ee8
SHA1 hash: fe875e37e98df087296d27a03428345035998696
MD5 hash: 6bc854cbed6886d1f9f805c60f1c3778
humanhash: speaker-kilo-tango-butter
File name:Contract#6067.iso
Download: download sample
Signature Quakbot
Create hunting rule
File size:1'157'120 bytes
First seen:2022-10-03 15:15:57 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:OwFOHrwcwjHmvwiK7Jb0y/cT5SLz5EVl5DC4HDbdnuj3HH:OwFOHrwcwjHmvwiKb1/cT5SZEVjVbdy3
TLSH T1D3355C13B3400332C26702706A5E76D6F32C9478772596A6649E897D33418FA9B7FFE8
TrID 98.8% (.NULL) null bytes (2048000/1)
0.5% (.WAR) Warcraft II game data archive (12007/4/6)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Reporter pr0xylife
Tags:BB iso Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
245
Origin country :
n/a
File Archive Information

This file archive contains 8 file(s), sorted by their relevance:

File name:purge.jpg
File size:35'477 bytes
SHA256 hash: a11b700babdc7b22bdaa833790716b432e82c9e196aaaab344bd6d4efeb7e94c
MD5 hash: 0b9167d578ddd702bb820640ed0f1a95
MIME type:image/jpeg
Signature Quakbot
File name:thrusters.txt
File size:125'131 bytes
SHA256 hash: 6384ac1ca3aa1e5b0135231e362af6f34b1a3b82b1282268d0d9241a20a5d9e5
MD5 hash: a754896e91e5bb19211368939ea012b4
MIME type:text/plain
Signature Quakbot
File name:pebbles.dat
File size:493'056 bytes
SHA256 hash: 1965dc57456d4fc01b6ce0f242d80776fe08a16354e6177255cba618348355ac
MD5 hash: d89521adaf6418e6ebe43b1a1a9d2af9
MIME type:application/x-dosexec
Signature Quakbot
File name:grandparents.txt
File size:256'512 bytes
SHA256 hash: 9fe812c674791b472e17f062c9f94200d558fc6fc85f851cce0e06b4eecf3eef
MD5 hash: 045925086490cb719cecc322e1b05603
MIME type:text/plain
Signature Quakbot
File name:depredating.txt
File size:177'177 bytes
SHA256 hash: bdfb4cdb6191e3cf7214c077dee595b42372a6d1d36001d1427ded9e38b86973
MD5 hash: ef9b0c9024a61d59a0c5bbd34d298416
MIME type:text/plain
Signature Quakbot
File name:perfunctorinessRehash.vbs
File size:237 bytes
SHA256 hash: c84838381dfad99dc6e26f0e413a38611feea4e8530abcee1b4260b82076551d
MD5 hash: f0d4ad5f3317320f8b85d38062a79008
MIME type:text/plain
Signature Quakbot
File name:Contract.lnk
File size:1'305 bytes
SHA256 hash: 6ec0ba7e0db0e097c729bf9cf80b270f0d8f7e7314cec7bf30b8c644f866e584
MD5 hash: c86d26c6773f581a96cc5198ee12830e
MIME type:application/octet-stream
Signature Quakbot
File name:irritationTemperateness.cmd
File size:61 bytes
SHA256 hash: ec9bed0d3bd243ae4db1d4c27642a363fa4f98dd13017f230cce0fb7324ed24b
MD5 hash: 5392444aa205e2fadda8b3c3daddb2ac
MIME type:text/x-msdos-batch
Signature Quakbot
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilLNK.Guinnesses.20220719.UNOFFICIAL
Create hunting rule

TwinWave.EviLNK.ICEDYouLearn.20220914.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
greyware packed
Link:
https://www.filescan.io/uploads/633afcb478d4acb349f48ac3/reports/399c57f3-50fe-40be-9b4b-6f66456e8480/overview
Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5578fbc2b70fb9c4a49bfb8b7b6fbe945febee193699fcc9c2aa46675d86f778/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kv4pxqvxb644jje37ofxw356srp6x3qzg2m7zsocvjdgoxmg654a._file
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/221003-snfnbscde3/
Behaviour
Enumerates physical storage devices
Malware Config
C2 Extraction:
99.221.33.122:35602
29.202.180.222:51620
23.94.40.182:4331
34.19.16.166:1288
241.163.135.223:50051
32.107.156.85:19172
228.49.142.11:64889
196.202.140.31:7400
110.114.87.194:23019
217.188.119.28:9613
29.44.169.79:27952
169.83.63.109:46511
47.65.80.200:49855
50.140.194.100:14738
152.64.159.219:41214
12.255.117.222:36282
199.246.11.177:40851
81.180.116.241:1057
87.3.215.226:21496
247.44.83.206:32161
110.141.155.115:21355
126.7.15.81:38878
246.166.147.15:42079
71.118.48.68:16876
240.237.58.79:52135
228.135.88.101:8170
37.13.235.189:18671
187.156.210.204:4243
146.54.170.64:61188
240.132.30.162:19966
23.207.217.71:260
125.250.215.162:30167
242.193.131.8:56589
188.7.186.109:6729
80.147.52.103:32403
232.222.181.12:36938
165.107.195.136:37237
193.129.246.98:0
162.224.55.111:30915
17.105.54.14:63284
149.253.253.235:19955
148.219.182.10:5489
56.214.171.2:7637
171.182.161.115:60821
175.2.110.61:49611
99.130.91.79:29604
136.197.36.254:0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5578fbc2b70fb9c4a49bfb8b7b6fbe945febee193699fcc9c2aa46675d86f778

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:iso_lnk
Create hunting rule
Author:tdawg
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments