MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1cf17385d9ca2d168e4ccde38f426ec8f9f27b9599d3974c53008e79595fc7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	f1cf17385d9ca2d168e4ccde38f426ec8f9f27b9599d3974c53008e79595fc7b
SHA3-384 hash:	a8a52735d4d87a7a21dd7227b84ec85c719ada76b7b899d247889d26ab83889d07aec2d86c842e196d075bdf868fbd9e
SHA1 hash:	5b58f0521d43491024180c60fcb0e2d9f658ac1c
MD5 hash:	953b8c6b72ebfad8d0c89427325dff94
humanhash:	oklahoma-neptune-april-nitrogen
File name:	A401.zip
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	17'151 bytes
First seen:	2023-05-02 22:47:26 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	384:y/NkuBL4J8wpR2yD3BeezkDcP0q2z8wJy/+AWjQv:nu9mfXDRJmcP0bgwJATWkv
TLSH	T13D72C00F67A16C6746DCE8BC04D0EA51D9EA05DA30E354F892490D67ECFDE8207879B9
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	rmceoin
Tags:	Qakbot qbot Quakbot zip

Intelligence

File Origin

# of uploads :

# of downloads :

413

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	A401.wsf
File size:	39'424 bytes
SHA256 hash:	104a969604a948f31314155205803b2446c620f6f5dd5b438e26e189febf57b9
MD5 hash:	99836f4f236daff04b190f0bd6359ff7
MIME type:	text/plain
Signature	Quakbot

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Foxhole.Wsf_Zip_1.UNOFFICIAL

Result

Verdict:

Unknown

File Type:

ZIP File

Link:

https://app.docguard.net/f1cf17385d9ca2d168e4ccde38f426ec8f9f27b9599d3974c53008e79595fc7b/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/645193235642c9c405e24d39/reports/11002ce2-e5ca-49f7-bc16-fdd933ebf824/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/f1cf17385d9ca2d168e4ccde38f426ec8f9f27b9599d3974c53008e79595fc7b

Result

Verdict:

SUSPICIOUS

Link:

https://labs.inquest.net/dfi/sha256/f1cf17385d9ca2d168e4ccde38f426ec8f9f27b9599d3974c53008e79595fc7b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f1cf17385d9ca2d168e4ccde38f426ec8f9f27b9599d3974c53008e79595fc7b/

Threat name:

Script-JS.Trojan.Seheq

Status:

Malicious

First seen:

2023-05-02 18:09:04 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

5 of 36 (13.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6hhrooc5tsrnc2heztpdr5bg5shz6j5zlgots5gfgaeopfmv7r5q._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f1cf17385d9ca2d168e4ccde38f426ec8f9f27b9599d3974c53008e79595fc7b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.