MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63ade90920f3c771336089bd7fe255a76d81781c761347e8016d81eadd5ae687. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63ade90920f3c771336089bd7fe255a76d81781c761347e8016d81eadd5ae687
SHA3-384 hash: 0f2ffeb30991218383d8972eadc7fdb96210a9c69f1b80a8c2791748a5af1108dab49a7ed0dc5b2e19ec47f414a2bc88
SHA1 hash: 07f07d651bc22033ce453e7375d0dc4e78287861
MD5 hash: 6d0d7e50918d6e7a30340223ed87292b
humanhash: football-arizona-fanta-triple
File name:Art#4224.iso
Download: download sample
Signature Quakbot
Create hunting rule
File size:1'261'568 bytes
First seen:2022-09-26 15:24:48 UTC
Last seen:2022-09-27 11:05:00 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:zVeK7bHY/DS6wku4EmQKyMeRP7IYqsS/HdcoO9u+5w9M4aQvcd:zZjMpn6oOScd
TLSH T1C8458D32F2914473C1732A39AD3BA7659D3ABE112E3869463FE81D4C4F396813D253A7
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter pr0xylife
Tags:1664184863 BB iso pw H436 Qakbot Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
265
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.ISOICEDAllTheWayOut.20220816.UNOFFICIAL
Create hunting rule

TwinWave.EviLNK.ICEDYouLearn.20220914.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6331c45117f5f4f7f090417e/reports/89e9d7cc-c3d6-4cd5-ac54-f015d2159f1e/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63ade90920f3c771336089bd7fe255a76d81781c761347e8016d81eadd5ae687/
Threat name:
Win32.Trojan.Injuke
Create hunting rule
Status:
Malicious
First seen:
2022-09-26 15:25:10 UTC
File Type:
Binary (Archive)
Extracted files:
47
AV detection:
6 of 41 (14.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mow6scja6pdxcm3arg6x7ysvu5wyc6a4oyjup2abnwa6vxk242dq._file
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot botnet:bb campaign:1664184863 banker stealer trojan
Link:
https://tria.ge/reports/220926-stlrjabbg5/
Behaviour
Enumerates physical storage devices
Malware Config
C2 Extraction:
197.204.227.155:443
123.23.64.230:443
173.218.180.91:443
111.125.157.230:443
70.49.33.200:2222
149.28.38.16:995
86.132.13.105:2078
149.28.38.16:443
45.77.159.252:995
45.77.159.252:443
149.28.63.197:995
144.202.15.58:443
45.63.10.144:443
45.63.10.144:995
149.28.63.197:443
144.202.15.58:995
39.121.226.109:443
177.255.14.99:995
134.35.10.30:443
99.232.140.205:2222
180.180.132.100:443
86.176.180.223:993
41.98.11.74:443
196.64.230.149:8443
68.224.229.42:443
41.111.72.234:995
196.64.237.130:443
190.44.40.48:995
70.51.132.197:2222
88.232.207.24:443
115.247.12.66:443
189.19.189.222:32101
72.88.245.71:443
217.165.97.141:993
191.97.234.238:995
119.82.111.158:443
88.237.6.72:53
100.1.5.250:995
96.234.66.76:995
186.64.67.34:443
66.181.164.43:443
193.3.19.37:443
197.94.84.128:443
41.96.130.46:80
187.205.222.100:443
139.228.33.176:2222
88.245.168.200:2222
110.4.255.247:443
89.211.217.38:995
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/63ade90920f3c771336089bd7fe255a76d81781c761347e8016d81eadd5ae687

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:iso_lnk
Create hunting rule
Author:tdawg

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments