MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69fc127cf404c0a8126d1489b099d67bef28852d47c0854d85d0df1ea9d7e903. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69fc127cf404c0a8126d1489b099d67bef28852d47c0854d85d0df1ea9d7e903
SHA3-384 hash: 686a72ddf91a44d96489f43d4ff016eea562528007f79b83dcb510ba61824854a5cc715f049c2c37840f478135e39752
SHA1 hash: 5e544d53f740b283acde982ab5af4a76718ef48e
MD5 hash: 19b3a84dc2fd71aadbe47458cbd0e4cd
humanhash: india-iowa-cardinal-ack
File name:60852.dll
Download: download sample
Signature Quakbot
Create hunting rule
File size:424'448 bytes
First seen:2023-02-07 18:25:21 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash ed7b82ba2c3d48fc4ed65dff68081358 (7 x Quakbot)
ssdeep 6144:Iubpx1ymed01f3UBRxFoNgKIlp6Ydc2Zo5QLxZ8Ex6kmh08PfJO8L:XN8d0dkfxFoNgKIlbdc2WQLy28
TLSH T19D940805B792873AFEC7E0BF0346829A9A74627BA433501E6514BD75FB303B1716E932
TrID 32.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
20.5% (.EXE) Win64 Executable (generic) (10523/12/4)
12.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
9.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter proxylife
Tags:dll obama237 Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
220
Origin country :
US US
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/361533/
Result
Verdict:
Clean
Maliciousness:
Verdict:
No Threat
Threat level:
  2/10
Confidence:
67%
Tags:
anti-debug anti-vm packed
Link:
https://www.filescan.io/uploads/63e297bf96add6d1cf49f5a2/reports/dba28126-0c67-400f-9303-f7e1a6adb46d/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/69fc127cf404c0a8126d1489b099d67bef28852d47c0854d85d0df1ea9d7e903
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/a5fe65d1-5045-409c-ba21-13f25ac2a7ed
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69fc127cf404c0a8126d1489b099d67bef28852d47c0854d85d0df1ea9d7e903/
Threat name:
Win32.Trojan.QakbotPacker
Create hunting rule
Status:
Malicious
First seen:
2023-02-07 18:26:10 UTC
File Type:
PE (Dll)
AV detection:
13 of 26 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nh6be7huatakqetncse3bgowppxsrbjni7aiktmf2dpr5kox5ebq._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230207-w27whsdb52/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
69fc127cf404c0a8126d1489b099d67bef28852d47c0854d85d0df1ea9d7e903
MD5 hash:
19b3a84dc2fd71aadbe47458cbd0e4cd
SHA1 hash:
5e544d53f740b283acde982ab5af4a76718ef48e
Link:
https://www.unpac.me/results/8b502666-607a-4bea-8c1a-492f697be8b7/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/69fc127cf404/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/69fc127cf404c0a8126d1489b099d67bef28852d47c0854d85d0df1ea9d7e903

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/361533/

Comments