MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09bf1ebc8306d6fa2539d09b3fdc22429bd2d894fe50c3dcc7e48f51b2f173b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	09bf1ebc8306d6fa2539d09b3fdc22429bd2d894fe50c3dcc7e48f51b2f173b4
SHA3-384 hash:	594b1ac2be2cf2d1be5c966a49a7f241cc259db56c0df48595dfb2f7d017a45c4dcac0589a6d8ce5711f4b0743e5136c
SHA1 hash:	a70cd5ac21c1c995878bd05922b761805d7ab884
MD5 hash:	6a7a2f2d6f8a7ad17ba138cf9b41e365
humanhash:	rugby-steak-purple-lima
File name:	uqtauouissqmi.zip
Download:	download sample
Signature	Dridex Alert Create hunting rule
File size:	1'093'512 bytes
First seen:	2022-04-19 08:54:15 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24576:xI6542f+ivVeMhHgo6p/0Bjsmg//j5yM36Pe8:xI6AivVhHgrFgsmg//jb3m3
TLSH	T1983533AA35E4FEF63310B52C39E087E95CE441E88116DBD92DB1899EF1F17C185E8A70
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	Olrac
Tags:	Dridex zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

1'253

Origin country :

n/a

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.SilentInvasion.20210310.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.XLSBLOLBINHammerToFall.20210414.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.QakysLoveOpensTheDoor.M2.20211223.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Excel File with Excel4Macro

Link:

https://app.docguard.net/09bf1ebc8306d6fa2539d09b3fdc22429bd2d894fe50c3dcc7e48f51b2f173b4/results/dashboard

Payload URLs

URL

File name

http://uri.etsi.org/01903#SignedProperties

sig1.xml

Document image

Image:

Download PNG

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

macros-on-open regsvr32 regsvr32.exe

Link:

https://www.filescan.io/uploads/625e78e7eab80a7a6c3ffa73/reports/7ba6de25-f407-4d18-869b-5f85ca0b8dfa/overview

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/09bf1ebc8306d6fa2539d09b3fdc22429bd2d894fe50c3dcc7e48f51b2f173b4/

ReversingLabs TitaniumCloud Document-Excel.Backdoor.Quakbot

Threat name:

Document-Excel.Backdoor.Quakbot

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-04-19 08:55:08 UTC

File Type:

Binary (Archive)

Extracted files:

44

AV detection:

16 of 37 (43.24%)

Threat level:

  5/5

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/220419-kvfb5seac2/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://debtsolversuk.co.uk/HLpeQJZi/NbVfNbhn.png
https://pablopereirasilvaluis.com.br/OHTvXEr9c/NbVfNbhn.png
https://portalregionpuno.com/088aFy0Xc8ap/NbVfNbhn.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Dridex

Threat name:

Dridex

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/09bf1ebc8306d6fa2539d09b3fdc22429bd2d894fe50c3dcc7e48f51b2f173b4