MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 73c6b431eb5a92719ba406a765d011aa709234af3675e9de4eff9c5f9edd3fe3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 73c6b431eb5a92719ba406a765d011aa709234af3675e9de4eff9c5f9edd3fe3
SHA3-384 hash: 76b4c2f6554b2921c649211ec8dedd8398c1ec6e1c113da424eb047e8b7eac793bcf353c11bd5107e29b37a1e3d13291
SHA1 hash: b1d69acda90232d836bc69ea3cbd9465ce3afdd3
MD5 hash: ab28ce01947066084d4af6583a6d3b54
humanhash: illinois-mockingbird-august-victor
File name:01.gif
Download: download sample
Signature Quakbot
Create hunting rule
File size:428'777 bytes
First seen:2023-02-07 17:10:55 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash ed7b82ba2c3d48fc4ed65dff68081358 (7 x Quakbot)
ssdeep 6144:+1bpx1ymed01f3UBRxFoNgKIlp6Ydc2ZiKm5baKrE7eh7PilAFNZzdnLf:sN8d0dkfxFoNgKIlbdc2IOaGlAFnBT
TLSH T1A9941905B792873AFEC7E0BF0346C29A9A74627AA433501E65107E75FB303B1756E932
TrID 32.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
20.5% (.EXE) Win64 Executable (generic) (10523/12/4)
12.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
9.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter proxylife
Tags:BB14 dll Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
221
Origin country :
IE IE
Vendor Threat Intelligence
Detection:
QakBot
Create hunting rule
Link:
https://www.capesandbox.com/analysis/361490/
Result
Verdict:
Clean
Maliciousness:
Verdict:
No Threat
Threat level:
  2/10
Confidence:
67%
Tags:
anti-debug anti-vm overlay packed
Link:
https://www.filescan.io/uploads/63e2862d89bd67c10fdd0b71/reports/95119b7a-8d22-4333-8d11-d3eb4cd071e1/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/73c6b431eb5a92719ba406a765d011aa709234af3675e9de4eff9c5f9edd3fe3
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4075dfe6-21a5-4f58-829c-f0486746786f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/73c6b431eb5a92719ba406a765d011aa709234af3675e9de4eff9c5f9edd3fe3/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2023-02-07 17:11:12 UTC
File Type:
PE (Dll)
AV detection:
20 of 26 (76.92%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=opdlimpllkjhdg5ea2twluarvjyjenfpgz26txso76of7hw5h7rq._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230207-vqaafaga8v/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
73c6b431eb5a92719ba406a765d011aa709234af3675e9de4eff9c5f9edd3fe3
MD5 hash:
ab28ce01947066084d4af6583a6d3b54
SHA1 hash:
b1d69acda90232d836bc69ea3cbd9465ce3afdd3
Link:
https://www.unpac.me/results/27073e3d-eb96-4dda-8561-79a78828b92d/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/73c6b431eb5a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/73c6b431eb5a92719ba406a765d011aa709234af3675e9de4eff9c5f9edd3fe3

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/361490/

Comments