MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c49b4d40b2925a4e5910e4157f7d302acf9203192187d3d1d178c258239f1c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 4


Intelligence 4 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c49b4d40b2925a4e5910e4157f7d302acf9203192187d3d1d178c258239f1c3
SHA3-384 hash: 01f2720de504cc387c178a045c7611b09141be837aaacae6b9f0bd31fdd59bf3a654c08de48fd5d93eb905ae2fd1c4b3
SHA1 hash: b9fabeb81466bba5f6c3032376d86352af032638
MD5 hash: 1d23c6234f44976e046d50144c2e9a30
humanhash: undress-florida-missouri-colorado
File name:65643.one
Download: download sample
Signature Quakbot
Create hunting rule
File size:189'464 bytes
First seen:2023-02-01 10:59:01 UTC
Last seen:Never
File type:Microsoft OneNote (one) one
MIME type:application/octet-stream
ssdeep 3072:0aA0YRw9/WITtTWR7IbNzvL1aTe/4uWt4AJERnyNenUWHCoTCCCCCCCCCCCCCCCs:ia9xytedL1ee/i4iERBh
TLSH T1C904C00266F106E5DAF47BB35DE39F196A27FE22B222075F47B6652D4DA4210CC04B1F
Reporter pr0xylife
Tags:1675243711 BB12 one Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
157
Origin country :
CA CA
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.OneNotePkillHTAScriptDeotnationRulingTheNation.20230125.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.OneNotePkillExeExtDetonationRulingTheNation.20230125.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/63da45f8447edb203a025d3f/reports/06a45d20-38e5-499d-acb4-5448ee9bec7b/overview
Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6c49b4d40b2925a4e5910e4157f7d302acf9203192187d3d1d178c258239f1c3/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nre3jvalfes2jzmrbzavp56takwpsibrsimh2pi5c6gclarz6hbq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.68
Link:
https://yomi.yoroi.company/submissions/6c49b4d40b2925a4e5910e4157f7d302acf9203192187d3d1d178c258239f1c3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:onenote_file
Create hunting rule
Description:Microsoft Onenote File
Rule name:OneNote_magic
Create hunting rule
Author:Stuart Gonzalez
Rule name:onenote_maldocs
Create hunting rule
Author:Stuart Gonzalez
Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments