MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a4d2138624f8eebbbd665597b1b9e7c3817c374e0e27327cf8acf1b5c57a4b10. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 6


Intelligence 6 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a4d2138624f8eebbbd665597b1b9e7c3817c374e0e27327cf8acf1b5c57a4b10
SHA3-384 hash: 5d7c5aa498cb53cb12b3411e2d85c5da9af473cfdfb8670861446f7d5f06e6bd2468dac1504385157ecd615db8ec791c
SHA1 hash: 6020f70869cb043a7447aed55c898f6cd4eba5ca
MD5 hash: 42dd7ae8f7ace56e7032d891f78e3bb1
humanhash: jig-double-twenty-white
File name:Notesvb.msi
Download: download sample
Signature Quakbot
Create hunting rule
File size:1'540'096 bytes
First seen:2024-01-25 18:30:53 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 24576:lfJdydmCcUsQ0Bigw3ywNfALfT9Qw4trPoMhlBb7/nSej8AfLRBRqJPim4z5Qn4:hJdaVcUsQ0Us7LbqhlBb7/nSej8AjRBd
Threatray 13 similar samples on MalwareBazaar
TLSH T10765E101BAD48536E67726342E2051258B7FBD744F3584EDFE48701A8E74E90CFBAB62
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Reporter pr0xylife
Tags:Ken Friedman AB msi Qakbot Quakbot signed

Code Signing Certificate

Organisation:Ken Friedman AB
Issuer:SSL.com EV Code Signing Intermediate CA RSA R3
Algorithm:sha256WithRSAEncryption
Valid from:2023-12-26T17:58:18Z
Valid to:2024-12-25T17:58:18Z
Serial number: 44e737228040233fcd8ded2bf108ce8c
Intelligence: 2 malware samples on MalwareBazaar are signed with this code signing certificate
MalwareBazaar Blocklist:This certificate is on the MalwareBazaar code signing certificate blocklist (CSCB)
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: d91b3734b2b549f587181526a2c03d484fdba23afc178adcaac1a2ce8a5e8909
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
198
Origin country :
AL AL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/472929/
Detection(s):
SecuriteInfo.com.Riskware.00584baa1.5921.21824.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  2.5/10
Confidence:
100%
Tags:
installer
Link:
https://www.filescan.io/uploads/65b2a8ee9d0df7771c921ec9/reports/3b66d746-c1ef-4746-ac8a-2e7e62218375/overview
Verdict:
Malicious
Labled as:
Malware/Generic
Link:
https://www.hybrid-analysis.com/sample/a4d2138624f8eebbbd665597b1b9e7c3817c374e0e27327cf8acf1b5c57a4b10
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/a4d2138624f8eebbbd665597b1b9e7c3817c374e0e27327cf8acf1b5c57a4b10
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
8 / 100
Link:
https://www.joesandbox.com/analysis/1381285
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a4d2138624f8eebbbd665597b1b9e7c3817c374e0e27327cf8acf1b5c57a4b10/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=utjbhbre7dxlxplgkwl3dophyoaxyn2obytte7hyvty3lrl2jmia._file
Verdict:
unknown
Similar samples:
1234d3750769ce978742d88d0818b9b54be4cbb0dcbe4c63a407ddfb67b18028
Quakbot
17fc8690f0f690c80af31d47573df647f81e9f3170aab5102b24aca8a0f9e8f9
Quakbot
2374fd5d049c1b8f1b7fd3115f035e9f154b1f04e1cc276507930811fe349399
Quakbot
6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
Quakbot
9c88b0caa2767d903e930306443c89e8d9a0f31208c225071855f2d1a693ba01
Quakbot
d9948bc3d500cfa0af44e63ad404708642bb1471508d88f77720c1e7369ee57c
Quakbot
f119f1e813cdb8dba30bd3348ef97cd8bf5213b3e1a9f25f008337e8b34eaee5
Quakbot
+ 3 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/240125-w5175scge8/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Drops file in Windows directory
Enumerates connected drives
Checks computer location settings
Loads dropped DLL
Blocklisted process makes network request
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Qakbot
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/a4d2138624f8eebbbd665597b1b9e7c3817c374e0e27327cf8acf1b5c57a4b10

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_OLE_file_magic_number
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:NET
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/472929/

Comments