MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c99d4c2d10e852395f892378225247f4e6eb2b5d9b9718e39127634e3acae3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 7


Intelligence 7 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c99d4c2d10e852395f892378225247f4e6eb2b5d9b9718e39127634e3acae3b
SHA3-384 hash: 2bae874255a26e6ff3901db3451864eb9e5fa0c71aeeca4cba64300995c2b7a90d62e1a1e497c7c76e80799913a62a7a
SHA1 hash: 7ceede56388bcdeda9e3aa6b024b27486e0b58e1
MD5 hash: bb3e166f8b0717e2c6c1047707a088ea
humanhash: jig-don-red-princess
File name:deskmon.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:1'088'000 bytes
First seen:2022-12-20 09:58:29 UTC
Last seen:2022-12-20 11:32:44 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash 5e2a8adbd67a9f695a7d7e5f915f640f (3 x Quakbot)
ssdeep 24576:Dxjz/fW1fil8KupGavkg3NyY+bbTNYIBAUZLYnTwFU0s:FXOg8KupGaXXEYIBAUZLYngx
TLSH T11E35D051F3C2DB63F6AFC1B45D679B6BA156ED134F2A042B76943B8DAE3239058C8403
TrID 30.2% (.EXE) Win64 Executable (generic) (10523/12/4)
18.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
14.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
12.9% (.EXE) Win32 Executable (generic) (4505/5/1)
5.9% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter lasq88
Tags:dll Qakbot qbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
211
Origin country :
PL PL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/348310/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.12832.18199.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
DNS request
Gathering data
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Monero
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/87a8cdab-0ffc-4b25-82f2-87ef16c8368d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9c99d4c2d10e852395f892378225247f4e6eb2b5d9b9718e39127634e3acae3b/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2022-12-19 23:31:13 UTC
File Type:
PE (Dll)
AV detection:
21 of 26 (80.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tsm5jqwrb2cshfpysi3yejjep5hg5mvv3g4xddrzcj3djy5mvy5q._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/221220-lz3hxacd3t/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
9c99d4c2d10e852395f892378225247f4e6eb2b5d9b9718e39127634e3acae3b
MD5 hash:
bb3e166f8b0717e2c6c1047707a088ea
SHA1 hash:
7ceede56388bcdeda9e3aa6b024b27486e0b58e1
Link:
https://www.unpac.me/results/9a384aed-1ddd-4ef1-bb43-7d2bb7af025b/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9c99d4c2d10e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c99d4c2d10e852395f892378225247f4e6eb2b5d9b9718e39127634e3acae3b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Quakbot

DLL dll 9c99d4c2d10e852395f892378225247f4e6eb2b5d9b9718e39127634e3acae3b

(this sample)

Quakbot

DLL dll 5D111ECC2EA0919B641B48A6E0D907466557EBEC1A6F5369DA93C44ABEB16697

  
Dropping
SHA256 5D111ECC2EA0919B641B48A6E0D907466557EBEC1A6F5369DA93C44ABEB16697
  
Delivery method
Distributed via e-mail attachment
Cape
Cape
https://www.capesandbox.com/analysis/348310/
  
Dropping
MD5 d77ce1693c7809bb5a38a6d2235545ae

Comments