MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bd040a74f99bd767652abc940a4939361d214ba6407781724fde55e48fa7aecf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 4


Intelligence 4 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bd040a74f99bd767652abc940a4939361d214ba6407781724fde55e48fa7aecf
SHA3-384 hash: e2e1da42cba5a5d11736a92216f76c20306e86a213c33538244e499750f0ed0e5923f9f3dfaf30a5c6fcfdeead1d9941
SHA1 hash: 5b48931a9f9ee8ec119046619c19780e8e97e572
MD5 hash: 90ece9f67237fa8cf4e1adc598ab905b
humanhash: beryllium-comet-beryllium-jersey
File name:215070.one
Download: download sample
Signature Quakbot
Create hunting rule
File size:172'568 bytes
First seen:2023-01-31 14:50:40 UTC
Last seen:Never
File type:Microsoft OneNote (one) one
MIME type:application/octet-stream
ssdeep 3072:Y1lg8QPXTRA2P/7dq+Jj29Ua2+jYF/EpHLz2TWtmD:JJtA2PRNJShnjZpHLKTWtmD
TLSH T1D3F3E003BA9FCD15DABE11B005B66FDBA721AD3283E29367577530D8AD222B0F44215F
Reporter pr0xylife
Tags:1675161160 BB12 one Qakbot qbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
171
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilDoc.OneNotePkillHTAScriptDeotnationRulingTheNation.20230125.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/63d92ad8447edb203a0243d1/reports/ff449cf1-441f-4e21-ab83-96e3239edccb/overview
Result
Verdict:
UNKNOWN
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bd040a74f99bd767652abc940a4939361d214ba6407781724fde55e48fa7aecf/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xucau5hztplwozjkxskausjzgyoscs5gib3yc4sp3zk6jd5hv3hq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.58
Link:
https://yomi.yoroi.company/submissions/bd040a74f99bd767652abc940a4939361d214ba6407781724fde55e48fa7aecf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:onenote_file
Create hunting rule
Description:Microsoft Onenote File
Rule name:OneNote_magic
Create hunting rule
Author:Stuart Gonzalez
Rule name:onenote_maldocs
Create hunting rule
Author:Stuart Gonzalez
Rule name:QbotStuff
Create hunting rule
Author:anonymous

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments