MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc97293401b033700c6ca626147931a8955262cf4203c0ecfa80a9d7d4b572d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cc97293401b033700c6ca626147931a8955262cf4203c0ecfa80a9d7d4b572d6
SHA3-384 hash:	6944f2a0e9e85299ad0ec754c4563791649a6869e67ef6c93cf384da7aa152194883c20c6a4cb95303075bff78582bd4
SHA1 hash:	56f0b64b40ab08216e9fe0c8d59ec64b23aaffbd
MD5 hash:	09776a770e5631e5bb66bc73f55ff6d9
humanhash:	purple-berlin-april-september
File name:	Open.bat
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	679 bytes
First seen:	2023-02-09 16:58:03 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	12:IGQJsKIAiOkVFvnzyLbPQ1pFgcLJ7VjtLQfPVjtLQgtvxqDgf7DUe:SJNmDl+LjIpOcLJ5SfdSaMaf
TLSH	T17301492C443114CDC033B78C8A7824C4E7B516961FADCD231A1D346B558EC28E935843
Reporter	proxylife
Tags:	bat obama239 Qakbot Quakbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

130

Origin country :

RU

Vendor Threat Intelligence

ANY.RUN qbot

Malware family:

n/a

ID:

1

File name:

795533.one

Verdict:

Malicious activity

Analysis date:

2023-02-09 16:58:38 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/cd7c6cf1-d286-459c-9e62-096aaf7e0321

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/362916/

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Launching a process

Creating a file in the %temp% directory

Launching cmd.exe command interpreter

Сreating synchronization primitives

Sending an HTTP GET request

Creating a window

FileScan.IO No Threat

Verdict:

No Threat

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/63e5261dfc4dffab0ccf7794/reports/7f819b6a-768e-4789-aee4-09ba70298124/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/cc97293401b033700c6ca626147931a8955262cf4203c0ecfa80a9d7d4b572d6

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Joe Sandbox malicious

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1170275

Signature

Sigma detected: Execute DLL with spoofed extension

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cc97293401b033700c6ca626147931a8955262cf4203c0ecfa80a9d7d4b572d6/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zslssnabwazxaddmuytbi6jrvckveywpiib4b3h2qcu5pvfvolla._file

Threatray qakbot

Verdict:

malicious

Label(s):

qakbot

Alert

Create hunting rule

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

n/a

Link:

https://tria.ge/reports/230209-vgtygscg3z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Blocklisted process makes network request

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/cc97293401b033700c6ca626147931a8955262cf4203c0ecfa80a9d7d4b572d6

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/362916/