krebs.dll.quarantine.quarantine

Classification: Malicious

krebs.dll.quarantine.quarantine is a ransomware (Windows executable, 464.0 KB). Flagged by 31% of antivirus engines (73 detections). Linked to Maze malware.

Detection summary

  • 73 antivirus detections (31% detection ratio)
  • 0 IDS alerts
  • 5 processes observed
  • 5 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: MAZE (S0449)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Gen:Variant.Ransom.Maze Hybrid-Analysis 2020-01-19 20:30:36 2020-01-19 20:30:36 S0449 Maze

Sample information

Filenames
krebs.dll.quarantine.quarantine
File type
PE32 executable (DLL) (GUI) Intel 80386, for MS Wi ...
Size
475136 bytes
MD5
f4bca1526e8010b57fc8e509b0b2a5d8
SHA-1
964360c0fc2c3676cac23a8015e4aa8acb023205
SHA-256
06aa258ca23392bcad370518d5b4a7d1f5c8840f26ec566d6ed349c00bd30cd8
First indexed
2020-01-19 20:30:36
Last updated
2026-10-03 03:33:22

Antivirus detections

EngineDetection
MicroWorld-eScanGen:Variant.Ransom.Maze.2
CylanceUnsafe
SangforMalware
CrowdStrikewin/malicious_confidence_100% (D)
Invinceaheuristic
SymantecRansom.Maze
APEXMalicious
ClamAVWin.Ransomware.Maze-7473772-0
BitDefenderGen:Variant.Ransom.Maze.2
Ad-AwareGen:Variant.Ransom.Maze.2
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.f4bca1526e8010b5
EmsisoftGen:Variant.Ransom.Maze.2 (B)
SentinelOneDFI - Suspicious PE
Endgamemalicious (high confidence)
ArcabitTrojan.Ransom.Maze.2
GDataGen:Variant.Ransom.Maze.2
AhnLab-V3Trojan/Win32.Kryptik.R307393
Acronissuspicious
ALYacGen:Variant.Ransom.Maze.2
MAXmalware (ai score=84)
eGambitUnsafe.AI_Score_68%
ALYacTrojan.Ransom.ChaCha
AVGWin32:Malware-gen
AlibabaRansom:Win32/Kryptik.b5d26d93
Antiy-AVLTrojan[Ransom]/Win32.Cryptor
AvastWin32:Malware-gen
AviraTR/Crypt.Agent.qkpqi
BkavW32.AIDetectMalware
CAT-QuickHealTrojan.Ghanarava.1629442945b2a5d8
CTXdll.ransomware.maze
ClamAVWin.Ransomware.Packer-7473772-1
CrowdStrikewin/malicious_confidence_100% (W)
CynetMalicious (score: 100)
DeepInstinctMALICIOUS
DrWebTrojan.Encoder.28416
ESET-NOD32a variant of Win32/Kryptik.HBPZ
ElasticWindows.Ransomware.Maze
F-SecureTrojan.TR/Crypt.Agent.qkpqi
FortinetW32/Agentb.ECQU!tr
GoogleDetected
GridinsoftRansom.Win32.Occamy.oa!s1
IkarusTrojan.Win32.Crypt
JiangminTrojan.Agentb.gvw
K7AntiVirusTrojan ( 0055f9d81 )
K7GWTrojan ( 0055f9d81 )
KasperskyTrojan-Ransom.Win32.Maze.ct
KingsoftWin32.Troj.Generic.yz
LionicTrojan.Win32.Maze.4!c
MaxSecureTrojan.Malware.1728101.susgen
McAfeeRansom-Maze-GYE!F4BCA1526E80
McAfeeDti!06AA258CA233
MicrosoftRansom:Win32/Maze!MTB
NANO-AntivirusTrojan.Win32.Encoder.gvssgc
Paloaltogeneric.ml
PandaTrj/GdSda.A
Rising[email protected] (RDML:Z2WegRBnE+2Nj3+/tCMt6A)
SangforTrojan.Win32.Save.a
SentinelOneStatic AI - Suspicious PE
SkyhighBehavesLike.Win32.VirRansom.gc
SophosTroj/Maze-C
SymantecRansom.Maze!gm
TencentWin32.Trojan.Maze.Qzfl
Trapminesuspicious.low.ml.score
TrendMicroTROJ_FRS.0NA103K920
TrendMicro-HouseCallTROJ_FRS.0NA103K920
VBA32Trojan.Agentb
VIPREGen:Variant.Ransom.Maze.2
VaristW32/Ransom.NR.gen!Eldorado
YandexTrojan.Kryptik!2Uv5kI5vlLU
ZillyaTrojan.Agent.Win32.1337579
ZoneAlarmTroj/Maze-C
huorongTrojan/Generic!19C8F94874952F2F

Network contacts

91.218.114.4 91.218.114.11 91.218.114.25 91.218.114.26 91.218.114.31

Process list

NameCommand line
<Ignored Process>
rundll32.exe"C:\krebs.dll.quarantine.quarantine.dll",#1
WMIC.exeshadowcopy delete
rundll32.exe"C:\krebs.dll.quarantine.quarantine.dll",#3
rundll32.exe"C:\krebs.dll.quarantine.quarantine.dll",#4