MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b69ce5e5977885bb314aa26dd4a56052fdf4b030f1c66a8a52ad90e80bc39fac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 6


Intelligence 6 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b69ce5e5977885bb314aa26dd4a56052fdf4b030f1c66a8a52ad90e80bc39fac
SHA3-384 hash: cfc2f2b6bda4d61c3a45d445ce4060522f6f187fb107ec9c918b3c33279d98c8c102daeca19d1f117fc91a8e0ff1c9a8
SHA1 hash: 31a51a429bd2e52bdd4a5443fc55c1a54c205a06
MD5 hash: b43c40200a9558e404585b8976698003
humanhash: xray-winter-hot-london
File name:KYC_EZ04(Feb15).one
Download: download sample
Signature Quakbot
Create hunting rule
File size:252'080 bytes
First seen:2023-02-15 16:38:59 UTC
Last seen:Never
File type:Microsoft OneNote (one) one
MIME type:application/octet-stream
ssdeep 3072:Ii7CxuGD55YnfrnL1BapaY5+qBp5GzrSAoEr5pCVc9MUcOgo3xxPXX3sQ:NfGD55YnDLiBhtGKipCm9Mp3Qx/Hh
TLSH T17E34F19BA7A05CAEC5A20379D6B253E35241FF236397463F54A8370D6D202C8E95D32F
Reporter k3dg3___
Tags:obama240 one qbot Quakbot TA570

Intelligence

File Origin
# of uploads :
1
# of downloads :
650
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.28804.Heur.BadOne.jse.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.VBS.Encrypted.Gen.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.OneNotePkillExeExtDetonationRulingTheNation.20230125.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.OneNoteQakyCamoLambos.20230203.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/63ed0aa9ae60232e30382269/reports/39c1600d-b465-4ad8-a063-95195d829350/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/b69ce5e5977885bb314aa26dd4a56052fdf4b030f1c66a8a52ad90e80bc39fac
Result
Verdict:
UNKNOWN
Result
Threat name:
Unknown
Detection:
malicious
Classification:
troj
Score:
48 / 100
Link:
https://www.joesandbox.com/analysis/1175917
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b69ce5e5977885bb314aa26dd4a56052fdf4b030f1c66a8a52ad90e80bc39fac/
Threat name:
Win32.Trojan.Malnote
Create hunting rule
Status:
Malicious
First seen:
2023-02-15 16:39:08 UTC
File Type:
Document
AV detection:
8 of 39 (20.51%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=w2oolzmxpcc3wmkkujw5jjlakl67jmbq6hdgvcssvwioqc6dt6wa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/230215-t5yqxace9x/
Behaviour
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in Windows directory
Drops startup file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b69ce5e5977885bb314aa26dd4a56052fdf4b030f1c66a8a52ad90e80bc39fac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:onenote_file
Create hunting rule
Description:Microsoft Onenote File
Rule name:OneNote_magic
Create hunting rule
Author:Stuart Gonzalez
Rule name:SUSP_OneNote
Create hunting rule
Author:spatronn
Description:Hard-Detect One

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Quakbot

Microsoft OneNote (one) one b69ce5e5977885bb314aa26dd4a56052fdf4b030f1c66a8a52ad90e80bc39fac

(this sample)

Quakbot

DLL dll e7e9e9ede8090e5bcf5ee8341f4540c21ace2e419b0d3a766c5e460313ca4328

  
Dropping
SHA256 e7e9e9ede8090e5bcf5ee8341f4540c21ace2e419b0d3a766c5e460313ca4328
  
Delivery method
Distributed via e-mail attachment

Comments