MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3130dab775404ad2fdeb6a295b3b68ff46e5d1ee05df35efeb5348e837f972a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3130dab775404ad2fdeb6a295b3b68ff46e5d1ee05df35efeb5348e837f972a
SHA3-384 hash: b7e9f5a59092533c46830953fc3341b613551e035a8b6c8552be4757c2d10e668395884836a3b3eb8f3c15cd18ce07cb
SHA1 hash: 01099a281a3c2124eac9344756a317cf3900aa95
MD5 hash: 07f46935f9ea6ee92ba3d2f6c6feb945
humanhash: tennis-wyoming-sixteen-pizza
File name:inonctnnIdu.html
Download: download sample
Signature Quakbot
Create hunting rule
File size:811'125 bytes
First seen:2022-09-26 12:40:26 UTC
Last seen:Never
File type: html
MIME type:text/html
ssdeep 12288:DGOAmnH/JI6j87U5TkqCJbI0wFq9IeV2Igy98xQVhQKfKnPivlrss/2kO+1IX:DGqy0TzRFqSY2jy97VhH99sgIX
TLSH T1670523075F35B8DF497C117D20FA2F090CE2C944D803B9BA119015EE5A9FB15EAA92EF
Reporter 0xToxin
Tags:1664184863 BB html Qakbot Quakbot

Intelligence

File Origin
# of uploads :
1
# of downloads :
225
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilHTML.PKillDlZipITDistantCitylights.202200617.UNOFFICIAL
Create hunting rule

TwinWave.EvilHTML.QakyDoRight.20220909.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated
Link:
https://www.filescan.io/uploads/63319de00569d591125faec4/reports/85ccdccd-5803-4714-b558-72314258f822/overview
Result
Verdict:
SUSPICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e3130dab775404ad2fdeb6a295b3b68ff46e5d1ee05df35efeb5348e837f972a/
Threat name:
Script.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2022-09-26 12:41:08 UTC
File Type:
Text (HTML)
Extracted files:
3
AV detection:
3 of 41 (7.32%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4mjq3k3xkqck2l66w2rjlm5wr72g4xi64bo7gxx6wu2i5a37s4va._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/e3130dab775404ad2fdeb6a295b3b68ff46e5d1ee05df35efeb5348e837f972a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:html_auto_download_b64
Create hunting rule
Author:Tdawg
Description:html auto download

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments