MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e16e0faae0e9851a782d026f6692e34a9c7bae14c545aa8ac1e1ef033dfd06a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e16e0faae0e9851a782d026f6692e34a9c7bae14c545aa8ac1e1ef033dfd06a8
SHA3-384 hash: 9c35bce0782b6ec36e3509e25eddae59798ab708ed45f3ead466b1e430cc066bd7d04bb7ef23fbc8db8c714b37606a92
SHA1 hash: 52975754a7e3048c5b587e4926e99cb5c8123929
MD5 hash: 891c7d5050fe852a032eeda9311498e8
humanhash: romeo-ink-yellow-ohio
File name:rei.dat
Download: download sample
Signature Quakbot
Create hunting rule
File size:314'368 bytes
First seen:2023-02-15 15:49:46 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 5684749ec732d84594f077726c28f1da (3 x Quakbot)
ssdeep 6144:0HnaNJs7Ly6xJQ54ZYzssoobhQUavcXwvV4fZcxq3iDqBJIjevit68lBFFY02:0HnaNuLy6bs4yzhoUhQUavcXlcwqeZAc
TLSH T15B648DEDFE47C8F5DA2B04F994CA7FAF892115838F618D71C6584F0AE851BB1601E70A
TrID 32.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
20.5% (.EXE) Win64 Executable (generic) (10523/12/4)
12.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
9.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.EXE) Win32 Executable (generic) (4505/5/1)
Reporter pr0xylife
Tags:1676453967 dll Qakbot Quakbot tok01

Intelligence

File Origin
# of uploads :
1
# of downloads :
252
Origin country :
RU RU
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/366762/
Result
Verdict:
Clean
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug packed
Link:
https://www.filescan.io/uploads/63ecff2d9dd76ac37fed52e1/reports/73ddcd53-d49d-466c-b810-8857f9d741b6/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e16e0faae0e9851a782d026f6692e34a9c7bae14c545aa8ac1e1ef033dfd06a8
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/effb6565-688c-471b-a406-d6a5ec5e96d1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e16e0faae0e9851a782d026f6692e34a9c7bae14c545aa8ac1e1ef033dfd06a8/
Threat name:
Win32.Backdoor.Quakbot
Create hunting rule
Status:
Malicious
First seen:
2023-02-15 15:50:07 UTC
File Type:
PE (Dll)
AV detection:
9 of 25 (36.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4fxa7kxa5gcru6bnajxwnexdjkohxlquyvc2vcwb4hxqgpp5a2ua._file
Verdict:
malicious
Label(s):
qakbot
Create hunting rule
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/230215-s9xtqscd4w/
Behaviour
Suspicious use of WriteProcessMemory
Program crash
Unpacked files
SH256 hash:
e16e0faae0e9851a782d026f6692e34a9c7bae14c545aa8ac1e1ef033dfd06a8
MD5 hash:
891c7d5050fe852a032eeda9311498e8
SHA1 hash:
52975754a7e3048c5b587e4926e99cb5c8123929
Link:
https://www.unpac.me/results/a21e06b7-0fba-4aa2-bc0c-85470f778071/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.96
Link:
https://yomi.yoroi.company/submissions/e16e0faae0e9851a782d026f6692e34a9c7bae14c545aa8ac1e1ef033dfd06a8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Quakbot

DLL dll e16e0faae0e9851a782d026f6692e34a9c7bae14c545aa8ac1e1ef033dfd06a8

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/366762/
  
URLhaus
https://urlhaus.abuse.ch/url/2541324/
  
Delivery method
Distributed via web download

Comments