MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c259bf6cdeab63308fdcd798420eb4cc01505602210388a17d8b276112fd3956. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c259bf6cdeab63308fdcd798420eb4cc01505602210388a17d8b276112fd3956
SHA3-384 hash: e69f6afcbb658ed4e898393725bd134972c486ccf593a76409b48bbd2851d71d4f3834680b9c350747565f9e947e757c
SHA1 hash: 613527c762679bfab85301dad692a5b79a317979
MD5 hash: 709e40b50b437aacf69db196d5af8976
humanhash: jupiter-cola-autumn-december
File name:84675.dat.dll
Download: download sample
Signature Quakbot
Create hunting rule
File size:656'056 bytes
First seen:2023-02-01 15:48:43 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash ba10210792cf2849761b9bb94eae1772 (8 x Quakbot)
ssdeep 12288:QljQRl3iZwl3JBrySD9CkkgC28DWl0RJK2LgAN4c1DJ92trs1tTm3+uZ:Q9WZiZCCMCkkBRDeSjcjc1DJ92ts1tCJ
TLSH T127D48D11EA4398BACD5713714223F72F1739E7A0A43ACBCBD99C2C29DD139D1B64970A
TrID 29.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
18.5% (.EXE) Win64 Executable (generic) (10523/12/4)
11.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
9.7% (.FON) Windows Font (5545/9/1)
8.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter James_inthe_box
Tags:dll Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/359119/
Result
Verdict:
Clean
Maliciousness:
Verdict:
No Threat
Threat level:
  2/10
Confidence:
100%
Tags:
anti-debug overlay packed spyeye
Link:
https://www.filescan.io/uploads/63da89ee89bd67c10fdc07f6/reports/12179384-8b08-4f86-9cdc-aaeebd8c8766/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/9417caed-6c78-4c59-9b33-550818661426
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c259bf6cdeab63308fdcd798420eb4cc01505602210388a17d8b276112fd3956/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2023-02-01 15:47:55 UTC
File Type:
PE (Dll)
AV detection:
14 of 26 (53.85%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yjm363g6vnrtbd6426meedvuzqavavqceebyril5rmtwcex5hfla._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/230201-s9blhaad92/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
c259bf6cdeab63308fdcd798420eb4cc01505602210388a17d8b276112fd3956
MD5 hash:
709e40b50b437aacf69db196d5af8976
SHA1 hash:
613527c762679bfab85301dad692a5b79a317979
Link:
https://www.unpac.me/results/0f4a16eb-6225-4d97-8765-0f90af6ae997/
Malware family:
QBot
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c259bf6cdeab/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/c259bf6cdeab63308fdcd798420eb4cc01505602210388a17d8b276112fd3956

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
Cape
Cape
https://www.capesandbox.com/analysis/359119/

Comments