MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 796ff26db045085ec8162d414cc2deafb2836d3f0bffd8c58af4595ebb4261e9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 6


Intelligence 6 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 796ff26db045085ec8162d414cc2deafb2836d3f0bffd8c58af4595ebb4261e9
SHA3-384 hash: 085222bd66cf98432bee866d4ea1271c202526352807fa9ef4adc0006fc1238e66d0f209820738e64309f41f1be345fa
SHA1 hash: 429eb61b8b3c82fcb0289ff110b2988aa71ebf1b
MD5 hash: 145a2fe0f191b819c40d909d04cc5b34
humanhash: colorado-fourteen-mike-arizona
File name:Learn#7435.iso
Download: download sample
Signature Quakbot
Create hunting rule
File size:835'584 bytes
First seen:2022-10-11 10:55:10 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:glDulxbcNzXEjchLTaZb+lJIwlD+Nb+lD1bXKHkI42r+a6dxSCoRSUtwRBLWONhC:7ZfZvgWr6RqSUtMLqPa9sbTGGAtt4
TLSH T13D054A032284EA72C0760130277B5BD5D32DDC743725CD9A62D8B86DE7394A27636BEB
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter syrion89
Tags:iso Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
n/a
File Archive Information

This file archive contains 6 file(s), sorted by their relevance:

File name:LearnS.lnk
File size:1'295 bytes
SHA256 hash: d5f09ebc9b1f3fb9781aca09e3b9fa63f90b909cc7418ff7d2afa462f400dce3
MD5 hash: 53ea89f8c240f8af4263eb83fa5b5e05
MIME type:application/octet-stream
Signature Quakbot
File name:rougher.gif
File size:32'624 bytes
SHA256 hash: 1bb07f50e3db85443521985fa67d710d20c34138a09b9007a1015d456d9b1f99
MD5 hash: 48d298297c11cae4b23d5a395a913f64
MIME type:image/gif
Signature Quakbot
File name:redressingLamentations.cmd
File size:116 bytes
SHA256 hash: 757d3c81555fbf635b2b9fd1d5222e6fe046710753395545a29e3e1f0a78fbf1
MD5 hash: d81fc042828755cb52fbb5f5eb64b3b7
MIME type:text/x-msdos-batch
Signature Quakbot
File name:regressing.txt
File size:147'387 bytes
SHA256 hash: bd3a47e0e27523044feb2c30879eb684cfd174ec329350baf5e0824ffff1a22f
MD5 hash: 15a294ab0e03627f82b68608644f0ee6
MIME type:text/plain
Signature Quakbot
File name:tiddler.dat
File size:592'896 bytes
SHA256 hash: 5b54f57dbaa74fa589afb2d26d6c6b39e0c2930bd88fea3172556ce96b3eb959
MD5 hash: 7754a35deec807d757f79165ba17708d
MIME type:application/x-dosexec
Signature Quakbot
File name:expeditionPresides.js
File size:243 bytes
SHA256 hash: 55ad915dcd65192548046ecbecda5ad8ad6a92a11f07ec9a92744fcac1599501
MD5 hash: ebde0c9ab4a61f7ed5dd2debb716ec3b
MIME type:text/plain
Signature Quakbot
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilLNK.Guinnesses.20220719.UNOFFICIAL
Create hunting rule

TwinWave.EviLNK.ICEDYouLearn.20220914.UNOFFICIAL
Create hunting rule

TwinWave.EvilISO.WLLIAMThatPower.20221005.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/63454bc548a09eabde10b5b1/reports/c302591c-9771-42b2-9637-e9daf8b38226/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/796ff26db045085ec8162d414cc2deafb2836d3f0bffd8c58af4595ebb4261e9/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-10-11 10:56:12 UTC
File Type:
Binary (Archive)
Extracted files:
81
AV detection:
18 of 42 (42.86%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pfx7e3nqiuef5sawfvauzqw6v6zig3j7bp75rrmk6rmv5o2cmhuq._file
Result
Malware family:
qakbot
Create hunting rule
Score:
  10/10
Tags:
family:qakbot banker stealer trojan
Link:
https://tria.ge/reports/221011-m1n8cabbe2/
Behaviour
Enumerates physical storage devices
Malware Config
C2 Extraction:
75.116.87.44:14933
64.55.103.194:9151
80.214.68.88:40730
97.184.129.40:2118
216.44.143.70:26851
239.39.127.10:38876
57.33.10.57:17737
201.128.252.151:58865
211.76.239.250:34506
124.58.65.86:13247
41.8.154.58:7614
6.55.240.195:27003
139.242.121.12:23370
8.81.30.103:64297
168.13.24.67:37382
17.219.125.20:59669
136.66.66.194:40287
63.172.177.141:57252
195.44.25.26:29277
67.212.106.154:59890
149.254.111.67:39052
184.74.22.12:50436
166.33.149.229:19515
172.102.164.60:43562
155.28.49.2:51545
7.122.114.191:33775
220.68.130.196:7948
121.236.113.177:14197
47.2.191.47:32393
49.93.218.109:41033
174.124.34.188:14831
178.143.168.245:48707
159.196.166.193:58136
1.104.105.37:49572
225.108.223.250:46683
105.208.24.120:59473
180.179.25.125:42514
236.83.216.21:0
90.29.227.242:1085
212.204.93.86:48405
115.34.223.65:24926
250.151.244.173:3488
16.95.145.59:42025
50.6.212.181:17804
23.86.160.130:53103
212.133.85.240:62503
122.125.236.31:0
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/796ff26db045085ec8162d414cc2deafb2836d3f0bffd8c58af4595ebb4261e9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:iso_lnk
Create hunting rule
Author:tdawg
Rule name:QakBot
Create hunting rule
Author:kevoreilly
Description:QakBot Payload
Rule name:Qakbot_IsoCampaign
Create hunting rule
Author:Malhuters
Description:Qakbot New Campaign ISO
Rule name:unpacked_qbot
Create hunting rule
Description:Detects unpacked or memory-dumped QBot samples
Rule name:win_qakbot_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.
Rule name:win_qakbot_malped
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.qakbot.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Dropped by
Qakbot

Comments