🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea25090f26e76a4d91a8d6fa325fe5068c341e7c002598ed7490caee8846d2ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 5


Intelligence 5 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea25090f26e76a4d91a8d6fa325fe5068c341e7c002598ed7490caee8846d2ca
SHA3-384 hash: a0026a10b3aef49c99cf7bd182a931fe8da6bbef83ec139cfa46feaaffcfa8e4546ce55e069be01e98f8149a64f165bb
SHA1 hash: 366c9cddbb36a798762f869ca7e0c187086827d7
MD5 hash: 70ebbb2e50b4f69cab93b9fc4ecdff4f
humanhash: dakota-nine-mike-black
File name:document-35068.iso
Download: download sample
Signature Quakbot
Create hunting rule
File size:722'944 bytes
First seen:2022-11-01 10:32:09 UTC
Last seen:2025-09-19 11:33:24 UTC
File type: iso
MIME type:application/x-iso9660-image
ssdeep 6144:0UybNmbA4k7pIp6vLMoimii4b2NdsPdG+DOirCOaC:obcbA4k7pvLCmii4b20g+buOa
TLSH T131F47D88F981B0B5D2A371F0402F560BF27B6969B41984D0F2ADD5E16FB898D6027F7C
TrID 99.4% (.NULL) null bytes (2048000/1)
0.2% (.ISO) ISO 9660 CD image (5100/59/2)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
0.0% (.ABR) Adobe PhotoShop Brush (1002/3)
Reporter proxylife
Tags:CG4Y80On IcedID iso Quakbot

Intelligence

File Origin
# of uploads :
2
# of downloads :
355
Origin country :
n/a
File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:demurest.cmd
File size:710 bytes
SHA256 hash: 364d346da8e398a89d3542600cbc72984b857df3d20a6dc37879f14e5e173522
MD5 hash: 586fe6d361ef5208fad28c5ff8a4579b
MIME type:text/plain
Signature Quakbot
File name:pimpliest_kufic.png
File size:138'289 bytes
SHA256 hash: c6294ebb7d2540ee7064c60d361afb54f637370287983c7e5e1e46115613169a
MD5 hash: 49524219dbd2418e3afb4e49e5f1805e
MIME type:image/png
Signature Quakbot
File name:templates544.png
File size:206'848 bytes
SHA256 hash: e71772b0518fa9bc6dddd370de2d6b0869671264591d377cdad703fa5a75c338
MD5 hash: 14f37c8690dda318f9e9f63196169510
MIME type:application/x-dosexec
Signature IcedID
File name:documents-9771.lnk
File size:2'818 bytes
SHA256 hash: 57842fe8723ed6ebdf7fc17fc341909ad05a7a4feec8bdb5e062882da29fa1a8
MD5 hash: 51e416c3d3be568864994449cd39caa1
MIME type:application/octet-stream
Signature Quakbot
Vendor Threat Intelligence
Detection(s):
TwinWave.EvilLNK.Guinnesses.20221019.UNOFFICIAL
Create hunting rule

Verdict:
No Threat
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6360f5dfa302f5faa598a5b0/reports/22887fa9-cde9-4e74-9e5c-d3c269693b81/overview
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ea25090f26e76a4d91a8d6fa325fe5068c341e7c002598ed7490caee8846d2ca/
Threat name:
Shortcut.Trojan.IcedID
Create hunting rule
Status:
Malicious
First seen:
2022-11-01 10:33:07 UTC
File Type:
Binary (Archive)
Extracted files:
5
AV detection:
6 of 41 (14.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5isqsdzg45ve3eni235dex7fa2gdiht4aaszr3lusdfo5ccg2lfa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
n/a
Link:
https://tria.ge/reports/221101-mss7bsbhgl/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Loads dropped DLL
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ea25090f26e76a4d91a8d6fa325fe5068c341e7c002598ed7490caee8846d2ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:iso_lnk
Create hunting rule
Author:tdawg
Rule name:QbotStuff
Create hunting rule
Author:anonymous
Rule name:Script_in_LNK
Create hunting rule
Author:@bartblaze
Description:Identifies scripting artefacts in shortcut (LNK) files.
Rule name:SUSP_EXE_in_ISO
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:Internal Research
Rule name:SUSP_VBS_in_ISO
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects ISO files that contain VBS functions
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments