MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07cf11ef78b1daacebb01f915f96d3b08e3ce8a14597a616e0adff0ffd5c6c2a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 7

Intelligence 7 IOCs YARA 4 File information Comments

SHA256 hash:	07cf11ef78b1daacebb01f915f96d3b08e3ce8a14597a616e0adff0ffd5c6c2a
SHA3-384 hash:	c14071bdb9dbe12b05d894057a2a76054ce5539f8cb3868d1fd87f36f5957ce3fcd8704a1d372ed45f61e4d3c0860633
SHA1 hash:	bfed707d7ec9c82770e40d8136082910709df4bb
MD5 hash:	602e35f154205b05229790f479e16610
humanhash:	michigan-magazine-network-harry
File name:	Compensation_1309891432_10052020.xls
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	71'680 bytes
First seen:	2020-10-06 18:02:43 UTC
Last seen:	2020-10-06 19:14:56 UTC
File type:	xls
MIME type:	application/vnd.ms-excel
ssdeep	1536:V17uDphYHceXVhca+fMHLtyeGx2zZ8NOiC1D6yzsFuBCKcUVsYRrq/Rep:V17uDphYHceXVhca+fMHLtyeGx2zZ8NW
TLSH	AE630696B395C81AD916877A8DD3D2EA2327FC418F5347473289F30F3EB91808A1765A
Reporter	abuse_ch
Tags:	abc014 Qakbot qbot Quakbot xls

abuse_ch

Quakbot payload URL:
http://arixplanet.ir/hcjophefnp/238428.png

Quakbot C2s:
190.30.185.80:443
75.136.40.155:443
151.73.118.54:443
24.138.77.61:443
84.247.36.26:443
80.240.26.178:443
69.11.247.242:443
71.163.222.203:443
65.131.72.17:995
109.93.11.111:995
80.14.209.42:2222
173.245.152.231:443
173.70.165.101:995
185.246.9.69:995
2.7.65.32:2222
77.30.32.191:995
72.28.255.159:995
69.40.16.109:443
108.46.145.30:443
207.255.161.8:993
89.42.142.35:443
199.247.22.145:443
24.43.22.220:993
45.32.155.12:443
71.187.170.235:443
74.75.237.11:443
71.126.139.251:443
2.50.159.48:2222
172.78.30.215:443
190.85.91.154:443
86.97.184.46:2222
156.213.145.107:443
190.220.8.10:443
74.73.27.35:443
24.53.49.240:2222
184.97.132.62:443
155.186.9.160:443
86.126.17.13:443
195.138.42.49:50001
207.246.75.201:443
96.227.127.13:443
45.77.193.83:443
199.116.241.147:443
95.77.144.238:443
96.30.198.161:443
208.99.100.129:443
72.204.242.138:32102
89.137.211.239:443
72.204.242.138:443
47.44.217.98:443
24.71.28.247:443
108.5.34.248:443
68.190.152.98:443
2.89.114.20:443
197.133.117.15:443
70.168.130.172:995
103.76.160.110:443
103.238.231.40:443
73.228.1.246:443
207.255.161.8:995
24.122.0.90:443
78.97.3.6:443
184.180.157.203:2222
72.204.242.138:53
72.204.242.138:990
98.26.50.62:995
93.113.177.152:443
86.163.174.33:2222
74.109.219.145:443
45.32.154.10:443
66.215.32.224:443
39.36.218.78:995
117.218.208.239:443
134.228.24.29:443
72.204.242.138:32100
217.162.149.212:443
71.19.217.23:443
72.190.101.70:443
207.255.18.67:443
72.204.242.138:50001
78.96.199.79:443
72.186.1.237:443
67.60.113.253:2222
95.179.247.224:443
199.247.16.80:443
80.195.103.146:2222
66.26.160.37:443
24.234.86.201:995
207.255.161.8:443
100.4.173.223:443
103.206.112.234:443
86.177.171.45:2222
216.201.162.158:443
144.139.47.206:443
31.215.193.110:443
77.27.174.49:995
93.149.253.201:2222
2.50.57.36:443
141.158.47.123:443
203.106.195.67:443
2.51.221.138:995
175.211.225.118:443
66.222.88.126:995
61.2.171.191:443
50.244.112.106:443
24.27.82.216:2222
70.174.20.7:443
184.98.103.204:995
72.204.242.138:20
96.18.240.158:443
35.134.202.234:443
74.105.52.200:443
81.133.234.36:2222
207.237.1.152:443
59.26.204.144:443
71.217.125.53:2222
95.77.223.148:443
86.126.230.176:443
2.50.131.64:443
90.175.88.99:2222
68.225.60.77:443
77.31.120.194:995
67.170.137.8:443
24.139.132.70:443
173.22.125.129:2222
71.80.66.107:443
213.31.203.109:2222
59.96.167.209:443
197.210.96.222:995
5.193.181.221:2078
31.5.168.31:443
86.126.108.242:2222
24.205.42.241:443
174.110.39.220:443
5.12.218.57:2222
5.12.255.109:443
203.198.96.200:443
61.230.5.67:443
65.102.136.20:995
94.52.160.116:443
47.138.201.136:443
73.225.67.0:443
24.255.176.233:443
31.5.21.66:443
95.76.109.181:443
69.123.179.70:443
24.28.183.107:995
108.30.125.94:443
68.46.142.48:995

Intelligence

File Origin

# of uploads :

# of downloads :

180

Origin country :

n/a

Vendor Threat Intelligence

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the %temp% directory

Launching the default Windows debugger (dwwin.exe)

Launching a process by exploiting the app vulnerability

Result

Threat name:

Hidden Macro 4.0

Detection:

malicious

Classification:

expl.evad

Score:

56 / 100

Link:

https://www.joesandbox.com/analysis/483155

Signature

Document exploit detected (UrlDownloadToFile)

Found abnormal large hidden Excel 4.0 Macro sheet

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/07cf11ef78b1daacebb01f915f96d3b08e3ce8a14597a616e0adff0ffd5c6c2a/

Threat name:

Document-Excel.Downloader.EncDoc

Status:

Malicious

First seen:

2020-10-06 14:50:29 UTC

AV detection:

15 of 29 (51.72%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a7hrd33ywhnkz25qd6iv7fwtwchdz2fbiwl2mfxavx7q77k4nqva._file

Result

Malware family:

qakbot

Score:

10/10

Tags:

trojan banker stealer family:qakbot

Link:

https://tria.ge/reports/201006-31266gxfee/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Checks SCSI registry key(s)

Checks processor information in registry

Enumerates system info in registry

Creates scheduled task(s)

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Office loads VBA resources, possible macro or embedded object present

Loads dropped DLL

Executes dropped EXE

Qakbot/Qbot

Malware Config

C2 Extraction:

190.30.185.80:443
75.136.40.155:443
151.73.118.54:443
24.138.77.61:443
84.247.36.26:443
80.240.26.178:443
69.11.247.242:443
71.163.222.203:443
65.131.72.17:995
109.93.11.111:995
80.14.209.42:2222
173.245.152.231:443
173.70.165.101:995
185.246.9.69:995
2.7.65.32:2222
77.30.32.191:995
72.28.255.159:995
69.40.16.109:443
108.46.145.30:443
207.255.161.8:993
89.42.142.35:443
199.247.22.145:443
24.43.22.220:993
45.32.155.12:443
71.187.170.235:443
74.75.237.11:443
71.126.139.251:443
2.50.159.48:2222
172.78.30.215:443
190.85.91.154:443
86.97.184.46:2222
156.213.145.107:443
190.220.8.10:443
74.73.27.35:443
24.53.49.240:2222
184.97.132.62:443
155.186.9.160:443
86.126.17.13:443
195.138.42.49:50001
207.246.75.201:443
96.227.127.13:443
45.77.193.83:443
199.116.241.147:443
95.77.144.238:443
96.30.198.161:443
208.99.100.129:443
72.204.242.138:32102
89.137.211.239:443
72.204.242.138:443
47.44.217.98:443
24.71.28.247:443
108.5.34.248:443
68.190.152.98:443
2.89.114.20:443
197.133.117.15:443
70.168.130.172:995
103.76.160.110:443
103.238.231.40:443
73.228.1.246:443
207.255.161.8:995
24.122.0.90:443
78.97.3.6:443
184.180.157.203:2222
72.204.242.138:53
72.204.242.138:990
98.26.50.62:995
93.113.177.152:443
86.163.174.33:2222
74.109.219.145:443
45.32.154.10:443
66.215.32.224:443
39.36.218.78:995
117.218.208.239:443
134.228.24.29:443
72.204.242.138:32100
217.162.149.212:443
71.19.217.23:443
72.190.101.70:443
207.255.18.67:443
72.204.242.138:50001
78.96.199.79:443
72.186.1.237:443
67.60.113.253:2222
95.179.247.224:443
199.247.16.80:443
80.195.103.146:2222
66.26.160.37:443
24.234.86.201:995
207.255.161.8:443
100.4.173.223:443
103.206.112.234:443
86.177.171.45:2222
216.201.162.158:443
144.139.47.206:443
31.215.193.110:443
77.27.174.49:995
93.149.253.201:2222
2.50.57.36:443
141.158.47.123:443
203.106.195.67:443
2.51.221.138:995
175.211.225.118:443
66.222.88.126:995
61.2.171.191:443
50.244.112.106:443
24.27.82.216:2222
70.174.20.7:443
184.98.103.204:995
72.204.242.138:20
96.18.240.158:443
35.134.202.234:443
74.105.52.200:443
81.133.234.36:2222
207.237.1.152:443
59.26.204.144:443
71.217.125.53:2222
95.77.223.148:443
86.126.230.176:443
2.50.131.64:443
90.175.88.99:2222
68.225.60.77:443
77.31.120.194:995
67.170.137.8:443
24.139.132.70:443
173.22.125.129:2222
71.80.66.107:443
213.31.203.109:2222
59.96.167.209:443
197.210.96.222:995
5.193.181.221:2078
31.5.168.31:443
86.126.108.242:2222
24.205.42.241:443
174.110.39.220:443
5.12.218.57:2222
5.12.255.109:443
203.198.96.200:443
61.230.5.67:443
65.102.136.20:995
94.52.160.116:443
47.138.201.136:443
73.225.67.0:443
24.255.176.233:443
31.5.21.66:443
95.76.109.181:443
69.123.179.70:443
24.28.183.107:995
108.30.125.94:443
68.46.142.48:995

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/07cf11ef78b1daacebb01f915f96d3b08e3ce8a14597a616e0adff0ffd5c6c2a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SharedStrings Create hunting rule
Author:	Katie Kleemola
Description:	Internal names found in LURK0/CCTV0 samples

Rule name:	SUSP_EnableContent_String_Gen Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious string that asks to enable active content in Office Doc
Reference:	Internal Research

Rule name:	SUSP_Excel4Macro_AutoOpen Create hunting rule
Author:	John Lambert @JohnLaTwC
Description:	Detects Excel4 macro use with auto open / close

Rule name:	SUSP_Office_Dropper_Strings Create hunting rule
Author:	Florian Roth
Description:	Detects Office droppers that include a notice to enable active content
Reference:	Internal Research