MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5e553f663871712e51fff2a9bce1ee16bf25c9aff746c931066e6c25f035ff5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5e553f663871712e51fff2a9bce1ee16bf25c9aff746c931066e6c25f035ff5
SHA3-384 hash: 89599f9d9abd395cca495418e81a6adee4febba9f6bbe8e67398c62571e6191ffee60aac9204f918adeb2ec167c5ada1
SHA1 hash: b90d02997e48396be347506a5df823c5ca7cdb2d
MD5 hash: 3a66324581fba6e1dcfd19befd53b34c
humanhash: indigo-maryland-comet-one
File name:3a66324581fba6e1dcfd19befd53b34c.dll
Download: download sample
Signature Quakbot
Create hunting rule
File size:1'437'796 bytes
First seen:2021-04-15 15:04:55 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 413398ffac649594b2b53c025e6614ac (8 x Quakbot)
ssdeep 24576:NvUmuTOq0mWsw5m04Rej8AuJ31gqXKsEAK/VjAh4AOISWy:NvsxUQd2PjAWLRR
Threatray 95 similar samples on MalwareBazaar
TLSH 3D656B32F2D2C437D4732A7C9D6AB2D9942A7D111D28981B7AE40F4C5F3A6813E2D2D7
Reporter abuse_ch
Tags:dll Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Malware.Midie-9852010-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Sending a UDP request
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5e553f663871712e51fff2a9bce1ee16bf25c9aff746c931066e6c25f035ff5/
Threat name:
Win32.Trojan.Midie
Create hunting rule
Status:
Malicious
First seen:
2021-04-13 14:11:46 UTC
AV detection:
20 of 47 (42.55%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yxsvh5tdq4lrfzi774vjxtq64fv7exe2752gzeyqm3tmexydl72q._file
Verdict:
unknown
Similar samples:
16a7669fb295872d866b35e8d534b50ff537ec8fa2831cef5eba034e711fc080
Quakbot
1b5b729d7d3c954efe6f4c43c2f70d130d7305b073b851bfb119c6c84a473599
Quakbot
2c94a7e8ffd221e0d563d8ccc9252b70cea56388ebd9b4441f9a728fa4020507
Quakbot
4234445e1e7ae3a364aa22f0cf78f81ef48b1237df828b99622bdd486838f4cb
Quakbot
59b1c54f0a9ecc48d6f2c567c4344411cde31ece7a1759b84cb84a8484792c13
Quakbot
6444ade4163af4453f7dade0e9a9bd29a69ad5e78e5ec0b729fbc42f7cc14d5b
Quakbot
70289206a05f5f5a83afa162b4fdbf5cd5d2ebfc9e8615d6d9e42ac839fd4302
Quakbot
7415acfc01aab21b05ce23c957a9a73fb0e6a563efb2e5dbf4451dc6a7d4ccdd
Quakbot
95b1af57dc6a824ea2eeec14ab041629dbbb75179f56723fe7426245ab67a0ea
Quakbot
b2a2fecf72a5b1266654a8400d0929f45b91ac3a491fce7a470c063872fc7958
Quakbot
+ 85 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/210415-2rrrztqqgx/
Behaviour
Suspicious use of WriteProcessMemory
Unpacked files
SH256 hash:
c5e553f663871712e51fff2a9bce1ee16bf25c9aff746c931066e6c25f035ff5
MD5 hash:
3a66324581fba6e1dcfd19befd53b34c
SHA1 hash:
b90d02997e48396be347506a5df823c5ca7cdb2d
Link:
https://www.unpac.me/results/b70afacc-4506-4cbc-be98-28a4e7478b9e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
qbot
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c5e553f663871712e51fff2a9bce1ee16bf25c9aff746c931066e6c25f035ff5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

DLL dll c5e553f663871712e51fff2a9bce1ee16bf25c9aff746c931066e6c25f035ff5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/1107439/
  
Delivery method
Distributed via web download

Comments