MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96bcdc8801252e98c32bdb640f7205eac2a8ba5231eb6b85c1cbcddfdae899d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 4


Intelligence 4 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96bcdc8801252e98c32bdb640f7205eac2a8ba5231eb6b85c1cbcddfdae899d7
SHA3-384 hash: 4f1bb44bee766307393d719c933296b2a5bf8da1f339482db3b0b8b6b3149b848d4bdbf03b9cfc5562d6556551891dbb
SHA1 hash: 30c0603df0c6966161b640f8ba56d857f262acf1
MD5 hash: 6e1259196f1e6d357638e19390773879
humanhash: vermont-sierra-queen-indigo
File name:DCIM 7720656.html
Download: download sample
Signature Quakbot
Create hunting rule
File size:332'252 bytes
First seen:2022-12-13 14:41:16 UTC
Last seen:Never
File type: html
MIME type:text/html
ssdeep 6144:5sGKfTuAwFtoN+44Rq8wnybl/vW2HsZd+n4l9K20826P2kmvymJ8C+peac:tJAfN+4KL+uMP2k4J8C1v
TLSH T14E6423527E095C195798B398A0FB681CFF0582424C4D82DBB32E65C7CBDB324EF475AA
Reporter pr0xylife
Tags:html obama227 pw-stp150 Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
169
Origin country :
RU RU
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.JS.Dropper-3.UNOFFICIAL
Create hunting rule

TwinWave.Encoder.Javascript_Obfuscator_Usage_Observed_M1.20220427.UNOFFICIAL
Create hunting rule

TwinWave.EvilHTML.PKillDlZipITDistantCitylights.202200617.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
stealer
Link:
https://www.filescan.io/uploads/63988f3cf6e448d42df85cbd/reports/43197639-d311-4bb7-a685-594d2488fa3a/overview
Result
Verdict:
UNKNOWN
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1133472
Signature
Uses 7zip to decompress a password protected archive
Yara detected Html Dropper
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 766196 Sample: DCIM 7720656.html Startdate: 13/12/2022 Architecture: WINDOWS Score: 52 41 Yara detected Html Dropper 2->41 8 chrome.exe 18 8 2->8         started        11 chrome.exe 2->11         started        process3 dnsIp4 35 192.168.2.1 unknown unknown 8->35 37 192.168.2.3 unknown unknown 8->37 39 2 other IPs or domains 8->39 13 unarchiver.exe 4 8->13         started        16 chrome.exe 8->16         started        process5 dnsIp6 43 Uses 7zip to decompress a password protected archive 13->43 19 cmd.exe 1 13->19         started        21 7za.exe 2 13->21         started        29 clients.l.google.com 142.250.180.174, 443, 49696, 49699 GOOGLEUS United States 16->29 31 www.google.com 142.250.184.100, 443, 49704, 49740 GOOGLEUS United States 16->31 33 3 other IPs or domains 16->33 signatures7 process8 process9 23 powershell.exe 36 19->23         started        25 conhost.exe 19->25         started        27 conhost.exe 21->27         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/96bcdc8801252e98c32bdb640f7205eac2a8ba5231eb6b85c1cbcddfdae899d7/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=s26nzcabeuxjrqzl3nsa64qf5lbkrossghvwxbobzpg57wxithlq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.06
Link:
https://yomi.yoroi.company/submissions/96bcdc8801252e98c32bdb640f7205eac2a8ba5231eb6b85c1cbcddfdae899d7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:QBOT_HTMLSmuggling_a
Create hunting rule
Author:Ankit Anubhav - ankitanubhav.info
Description:Detects QBOT HTML smuggling variants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments