MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b440ad96f7ed8319419fbae878d48db0ad81107ede8ef862f8f0dc65ea8b527. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b440ad96f7ed8319419fbae878d48db0ad81107ede8ef862f8f0dc65ea8b527
SHA3-384 hash: 2f51ae466d303a420431afc54f2e62513ad6c3c11c60747ba19ade76c9c9264ec8e9210dc3a095405556640c76ab7a03
SHA1 hash: e5ba03ae33dc96025ce99e0469dbc61a5c4d2e21
MD5 hash: b93bd94b8f568deac0143bf93f7d8bd8
humanhash: two-failed-oscar-avocado
File name:Gall1063127896.zip
Download: download sample
Signature Quakbot
Create hunting rule
File size:309'790 bytes
First seen:2022-09-28 09:01:31 UTC
Last seen:Never
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: H322
ssdeep 6144:E+4zFwxoQQ2kIUDCELQZUIHQfCdPmZuoTQM0/Cx1jKRmw9WwWVsywW2:E+UFwxBQ2kIUWEakpsY0/6JKd07Vlwv
TLSH T18E6423B83B3CB90982D6C15C0F47065C0EE14AFBDA195793053E1CA2006A6EBFB6C97D
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter pr0xylife
Tags:1664292152 BB pw H322 Qakbot Quakbot zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
1'270
Origin country :
n/a
File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:italicized.jpg
File size:33'159 bytes
SHA256 hash: 640319105521d41d47492f1cc1c0f37cd09ef13d5c675475f81a64e19f224216
MD5 hash: 0c7a028e540bda66bf5fa5245fcb1085
MIME type:image/jpeg
Signature Quakbot
File name:overcomes.db
File size:509'952 bytes
SHA256 hash: 77c178fd8352352884cd00bf68138b6308f56d209df035ca506dfbe57be85831
MD5 hash: dbbec6076fdfec83733069beb07b7735
MIME type:application/x-dosexec
Signature Quakbot
File name:debenturesLucerne.cmd
File size:73 bytes
SHA256 hash: c92d1b2bad731c7a9bde61c2f0c8d5caa6b87ab0f50df4788205c45cf378691c
MD5 hash: e9a9b20eb05d5df15e770ba245e6d8c1
MIME type:text/x-msdos-batch
Signature Quakbot
File name:GalleryA.lnk
File size:1'299 bytes
SHA256 hash: 7d12b13bd6b58cf7ab0673952ac49b04a123cf186ca3b527d16fc86a8552120c
MD5 hash: 829150a717f01f82dd7cfb50ff8d9eaa
MIME type:application/octet-stream
Signature Quakbot
File name:gymnastsDenationalizes.js
File size:213 bytes
SHA256 hash: 1053808ab2ffee49dd102084a5f413313715879c7d61c3edd3b8e95797c5d7a3
MD5 hash: 4e3753e2ea948234db49d8e4d5785e71
MIME type:text/plain
Signature Quakbot
Vendor Threat Intelligence
Gathering data
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/8b440ad96f7ed8319419fbae878d48db0ad81107ede8ef862f8f0dc65ea8b527
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b440ad96f7ed8319419fbae878d48db0ad81107ede8ef862f8f0dc65ea8b527/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rncavwlpp3mddfaz7oxipdki3mfnqeih5xuo7brpr4g4mxviwutq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/8b440ad96f7ed8319419fbae878d48db0ad81107ede8ef862f8f0dc65ea8b527

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments