MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9a1328f3107582e58d4fef064f2d3998b658ccc513f9e98a513f5606400d9be. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	b9a1328f3107582e58d4fef064f2d3998b658ccc513f9e98a513f5606400d9be
SHA3-384 hash:	69257617f59501e39954529d69ceb302ea2e5296d73c619c337a09d84a3c0d9d0d1cdd15f1567588f0f31f52ed470895
SHA1 hash:	bce340ed6fdbcf824bacb2efeb8c3e8d02fefd80
MD5 hash:	3b26b958ce9f351ab082e2d98f8f36bc
humanhash:	uncle-hot-single-cardinal
File name:	G1539363431.zip
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	400'103 bytes
First seen:	2022-09-30 10:37:30 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	12288:lKGIYstCWvC6IsCyXfaYNeFUU6+2wZWd8py/:lrPDWa6+ueFE4ZWd5/
TLSH	T12E84237C8EA827D10DEAA37BECA196B01F49BCA5B87D9117076FC990070FDD06536706
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	pr0xylife
Tags:	1664437404 BB pw U492 Qakbot Quakbot zip

Intelligence

File Origin

# of uploads :

# of downloads :

1'275

Origin country :

n/a

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.62425239.18662.18363.UNOFFICIAL

Gathering data

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/b9a1328f3107582e58d4fef064f2d3998b658ccc513f9e98a513f5606400d9be

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b9a1328f3107582e58d4fef064f2d3998b658ccc513f9e98a513f5606400d9be/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xgqtfdzra5mc4wgu73ygj4wttgfwldgmke7z5gffcp2wazaa3g7a._file

Gathering data

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b9a1328f3107582e58d4fef064f2d3998b658ccc513f9e98a513f5606400d9be

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	PassProtected_ZIP_ISO_file Create hunting rule
Author:	_jc
Description:	Detects container formats commonly smuggled through password-protected zips