MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b91340d156582060095227e8d26f29f5ffc8b0e8fbf35a392b649adc60a5d4ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b91340d156582060095227e8d26f29f5ffc8b0e8fbf35a392b649adc60a5d4ab
SHA3-384 hash: 5ffd6638ffd7876da43d959aa5b864a4c2ce4e5982384c8da9655921cabee6b516730feac40b468b9c976b86f0fc448f
SHA1 hash: 6af6ec8f3c3434442c9ded389568e6a5ceffc491
MD5 hash: 4b80f9e2ad1f7ef034f9ccedf45de33d
humanhash: lake-william-alpha-princess
File name:adeP1F.dll
Download: download sample
Signature Quakbot
Create hunting rule
File size:425'700 bytes
First seen:2023-02-20 11:51:11 UTC
Last seen:2023-02-20 13:32:39 UTC
File type:DLL dll
MIME type:application/x-dosexec
ssdeep 6144:wNdLVrwwya0SU50lCtsDKxNNuNtrdO8xXB4LDhW7q4jr61bm:wNdLVrwpaJUKwSWxNs68YLDcq4jr6
Threatray 1'969 similar samples on MalwareBazaar
TLSH T14D943B54FF4713F0EE0354F8814BFB7F6B381E1185658EBADBB14F68E5A1A69840E608
TrID 32.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
20.5% (.EXE) Win64 Executable (generic) (10523/12/4)
12.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
9.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter pr0xylife
Tags:1676886180 BB16 dll Qakbot Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
262
Origin country :
RU RU
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/368406/
Detection(s):
SecuriteInfo.com.Win32.Evo-gen.29455.24459.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
67%
Tags:
anti-debug overlay packed
Link:
https://www.filescan.io/uploads/63f35ee801b99ad33e7ea6d3/reports/5437ad40-4673-4efe-9329-916618349d26/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_60%
Link:
https://www.hybrid-analysis.com/sample/b91340d156582060095227e8d26f29f5ffc8b0e8fbf35a392b649adc60a5d4ab
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/76beafbd-f25b-420a-bd50-ca4dad22a267
Result
Threat name:
Unknown
Detection:
clean
Classification:
n/a
Score:
6 / 100
Link:
https://www.joesandbox.com/analysis/1179165
Behaviour
Behavior Graph:
n/a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b91340d156582060095227e8d26f29f5ffc8b0e8fbf35a392b649adc60a5d4ab/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2023-02-20 11:52:10 UTC
File Type:
PE (Dll)
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xejubukwlaqgackse7une3zj6x74rmhi7pzvuojlmsnnyyff2svq._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Similar samples:
0307ab4d314e349614030c4fde71a9d5f0fba388efcc24dd621ccf8466166c8f
Quakbot
402dc9f0deb84bc6a911e6a13a953a6049e9eb79203968ca5cb123b21dd349f4
Quakbot
5d139b4f25ad0cbc6e9a81573520519a70079581869f63fce35434e7b095a4b4
Quakbot
6f99171c95a8ed5d056eeb9234dbbee123a6f95f481ad0e0a966abd2844f0e1a
Quakbot
88fae62ee9c09b67123d42a4ddc9dce679e5508668b60d2a3d869578bc652ad8
Quakbot
e16e0faae0e9851a782d026f6692e34a9c7bae14c545aa8ac1e1ef033dfd06a8
Quakbot
e7e9e9ede8090e5bcf5ee8341f4540c21ace2e419b0d3a766c5e460313ca4328
Quakbot
+ 1'959 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230220-n1qxlsah62/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
b91340d156582060095227e8d26f29f5ffc8b0e8fbf35a392b649adc60a5d4ab
MD5 hash:
4b80f9e2ad1f7ef034f9ccedf45de33d
SHA1 hash:
6af6ec8f3c3434442c9ded389568e6a5ceffc491
Link:
https://www.unpac.me/results/7ffe8117-4dab-4f38-908f-f119902ed7e6/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/b91340d156582060095227e8d26f29f5ffc8b0e8fbf35a392b649adc60a5d4ab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/368406/

Comments