🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be604dc018712b1b1a0802f4ec5a35b29aab839f86343fc4b6f2cb784d58f901. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 2


Intelligence 2 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be604dc018712b1b1a0802f4ec5a35b29aab839f86343fc4b6f2cb784d58f901
SHA3-384 hash: 424cd9600ea8e962f3a88adefe798b403080f0c8f07d8210611ea84ab736e27eab98d9fc2e4d824b0eef9228330137fb
SHA1 hash: 7bd217554749f0f3c31957a37fc70d0a86e71fc3
MD5 hash: 4f4231ca9e12aafac48a121121c6f940
humanhash: artist-stream-indigo-bravo
File name:bc8a3f79-94d7-43c5-bf5c-8d164ba1c859.zip
Download: download sample
Signature Quakbot
Create hunting rule
File size:226'667 bytes
First seen:2022-11-01 10:31:55 UTC
Last seen:2025-09-19 11:32:28 UTC
File type: zip
MIME type:application/zip
Note:This file is a password protected archive. The password is: CG4Y80On
ssdeep 6144:fVjsN3XWRCwiZ4s5RAxzuZ8ckpj51OasCVhfBD:ficRCwiZH5REzuGLkohf9
TLSH T1F92423B4B6278C5521AF7C6497DAFE8B23658F80B88E7215802D0495EC85CFD6BDDC82
TrID 80.0% (.ZIP) ZIP compressed archive (4000/1)
20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter proxylife
Tags:CG4Y80On IcedID nokoyawa pw-CG4Y80On Quakbot zip

Intelligence

File Origin
# of uploads :
3
# of downloads :
362
Origin country :
n/a
File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:demurest.cmd
File size:710 bytes
SHA256 hash: 364d346da8e398a89d3542600cbc72984b857df3d20a6dc37879f14e5e173522
MD5 hash: 586fe6d361ef5208fad28c5ff8a4579b
MIME type:text/plain
Signature Quakbot
File name:pimpliest_kufic.png
File size:138'289 bytes
SHA256 hash: c6294ebb7d2540ee7064c60d361afb54f637370287983c7e5e1e46115613169a
MD5 hash: 49524219dbd2418e3afb4e49e5f1805e
MIME type:image/png
Signature Quakbot
File name:templates544.png
File size:206'848 bytes
SHA256 hash: e71772b0518fa9bc6dddd370de2d6b0869671264591d377cdad703fa5a75c338
MD5 hash: 14f37c8690dda318f9e9f63196169510
MIME type:application/x-dosexec
Signature IcedID
File name:documents-9771.lnk
File size:2'818 bytes
SHA256 hash: 57842fe8723ed6ebdf7fc17fc341909ad05a7a4feec8bdb5e062882da29fa1a8
MD5 hash: 51e416c3d3be568864994449cd39caa1
MIME type:application/octet-stream
Signature Quakbot
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.63304008.23926.16899.UNOFFICIAL
Create hunting rule

Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be604dc018712b1b1a0802f4ec5a35b29aab839f86343fc4b6f2cb784d58f901/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xzqe3qayoevrwgqial2oywrvwknkxa47qy2d7rfw6lfxqtky7eaq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/221101-mss7bsbhgk/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/be604dc018712b1b1a0802f4ec5a35b29aab839f86343fc4b6f2cb784d58f901

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments