MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e547e1c00c7bd5a0cb060a4cdd801b284c4d73ef4f23d65ea747522aa786bba5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	e547e1c00c7bd5a0cb060a4cdd801b284c4d73ef4f23d65ea747522aa786bba5
SHA3-384 hash:	45d7c8be59506e7e5156d7d48a9b0e43cd7df9f41ce725b43d112c6bb5e74ac8fb6ae22d514090a0904ee49841c77a13
SHA1 hash:	01671f4331a7a362ef8cb1f49fd9172528311b3a
MD5 hash:	64cc940af0ebea2626d156bdac505c3c
humanhash:	maine-uncle-lima-oregon
File name:	2025_10rechnung_5605355625_sign.pdf (1).lnk
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	1'293 bytes
First seen:	2025-10-15 18:29:02 UTC
Last seen:	Never
File type:	lnk
MIME type:	application/x-ms-shortcut
ssdeep	24:8ecCwJ3zuOtgA56d+/x4dP4y+SKYqV5pvpSwyn7mLb:8ecCwVzP3B4dPD+3BHRc7w
TLSH	T1E02100106BED5B71F2B60F320977B3255EB7B809E912872D4084408C1C36B15DD78F27
Magika	lnk
Reporter	smica83
Tags:	lnk Quakbot

Intelligence

File Origin

# of uploads :

# of downloads :

252

Origin country :

Vendor Threat Intelligence

Detection(s):

TwinWave.EvilLNK.LOLBinOddLook.20220523.UNOFFICIAL

TwinWave.EvilLNK.LOLBinOddLook.20220622.UNOFFICIAL

TwinWave.EvilLNK.OddLook.202207213.UNOFFICIAL

TwinWave.EvilLNK.KingForADaywscript.20231121.UNOFFICIAL

TwinWave.EvilLNK.CrimeFlareInternetWreckage.20240723.UNOFFICIAL

TwinWave.EvilLNK.CrimeFlareInternetWreckage.20240814.UNOFFICIAL

TwinWave.EvilLNK.CrimeFlareLOLBIN.20240903.UNOFFICIAL

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68efe81397a16d00a8da480e

Tags:

stration virus miner

Result

Verdict:

Malicious

File Type:

LNK File - Malicious

Link:

https://app.docguard.net/e547e1c00c7bd5a0cb060a4cdd801b284c4d73ef4f23d65ea747522aa786bba5/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

lolbin masquerade opendir opendir webdav wscript

Link:

https://www.filescan.io/uploads/68efe80c3fe1a004456a542a/reports/8a8b34f0-2b67-45d0-95d3-5f050ff1b71d/overview

Verdict:

Malicious

Labled as:

TrojanDownloader/LNK.Agent

Link:

https://www.hybrid-analysis.com/sample/e547e1c00c7bd5a0cb060a4cdd801b284c4d73ef4f23d65ea747522aa786bba5

Verdict:

Malicious

File Type:

lnk

First seen:

2025-10-15T15:39:00Z UTC

Last seen:

2025-10-15T15:55:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.WinLNK.Agent.gen

Link:

https://opentip.kaspersky.com/e547e1c00c7bd5a0cb060a4cdd801b284c4d73ef4f23d65ea747522aa786bba5/results?tab=lookup

Result

Threat name:

MalLnk

Detection:

malicious

Classification:

troj

Score:

60 / 100

Link:

https://www.joesandbox.com/analysis/1796016

Signature

Multi AV Scanner detection for submitted file

Wscript called in batch mode (surpress errors)

Yara detected malicious lnk

Behaviour

Behavior Graph:

Download SVG

Verdict:

Malware

YARA:

3 match(es)

Tags:

LNK LNK: Script Execution Malicious T1218

Link:

https://app.malva.re/file/64cc940af0ebea2626d156bdac505c3c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e547e1c00c7bd5a0cb060a4cdd801b284c4d73ef4f23d65ea747522aa786bba5/

Verdict:

Malicious

Threat:

Trojan-Downloader.WinLNK.Agent

Link:

https://tip.neiki.dev/file/e547e1c00c7bd5a0cb060a4cdd801b284c4d73ef4f23d65ea747522aa786bba5

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2025-10-15 18:29:35 UTC

File Type:

Binary

AV detection:

10 of 38 (26.32%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4vd6dqamppk2bsygbjgn3aa3fbge247pj4r5mxvhi5jcvj4gxosq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251015-w4621agk4x/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.08

Link:

https://yomi.yoroi.company/submissions/e547e1c00c7bd5a0cb060a4cdd801b284c4d73ef4f23d65ea747522aa786bba5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.