MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70d8f263a41bc7606968ed192e027338c7ff63a1dc80675b039cfac2861bcebc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 70d8f263a41bc7606968ed192e027338c7ff63a1dc80675b039cfac2861bcebc
SHA3-384 hash: db2aed7d7cbc74d8c0e9384ce9e4335fa3cf8434600cb51eef5f34a478ce1425ed1407cec845d2e4f8273ab4dcefcbd5
SHA1 hash: 13817415ad9d42bfbe6868d5965a8c39c12ac737
MD5 hash: 4f1024e88cea6dbddfa8e88795a59695
humanhash: carolina-montana-nevada-fix
File name:780683.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:336'896 bytes
First seen:2023-02-08 16:40:42 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 0cc8ba71b98afd867de0195f0d6030f9 (5 x Quakbot)
ssdeep 6144:z8HwSJZ88IKeVSi5CHvJITRTcKY+UC6vmtmHkRCTZHmR/UYSbO28m2XQ9MW:z8HwSJG83i5CPqTCKY+cOB/UnbrwXQ+W
TLSH T1DA646E16A60398F6C85736B31297E1DF3A34E709C4105F5DDFF81C24FBBA900A5B926A
TrID 32.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
20.5% (.EXE) Win64 Executable (generic) (10523/12/4)
12.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
9.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter pr0xylife
Tags:dll obama238 Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
235
Origin country :
GH GH
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/362082/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug packed
Link:
https://www.filescan.io/uploads/63e3d0a1d68ac683b34afe9d/reports/0fb484bb-baf0-4720-b369-2e145a0fbc88/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/70d8f263a41bc7606968ed192e027338c7ff63a1dc80675b039cfac2861bcebc
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/f3c5244b-096e-4c84-a993-6c14c1af3a9a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/70d8f263a41bc7606968ed192e027338c7ff63a1dc80675b039cfac2861bcebc/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2023-02-08 16:41:07 UTC
File Type:
PE (Dll)
AV detection:
17 of 26 (65.38%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=odmpey5edpdwa2li5ums4atthdd76y5b3sagowydtt5mfbq3z26a._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230208-t6321scc6t/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
70d8f263a41bc7606968ed192e027338c7ff63a1dc80675b039cfac2861bcebc
MD5 hash:
4f1024e88cea6dbddfa8e88795a59695
SHA1 hash:
13817415ad9d42bfbe6868d5965a8c39c12ac737
Link:
https://www.unpac.me/results/94549da3-9d55-4b2b-8430-c1da404bacec/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/70d8f263a41b/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/70d8f263a41bc7606968ed192e027338c7ff63a1dc80675b039cfac2861bcebc

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/362082/

Comments