MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b9347900e27559ba3fcfe186a57ee8d28f8c949442a5d12a4bf9f7ed459114d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 9

Maldoc score: 10

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	7b9347900e27559ba3fcfe186a57ee8d28f8c949442a5d12a4bf9f7ed459114d
SHA3-384 hash:	fa32a79f629cb00d646290af33f764fddda8f74bff3fa0a43be15e9cb2a61ee8ed2a2fdb32981e185fc04de9d013d47e
SHA1 hash:	89bca4aae18925b44b7a6424567d15f8a0139c21
MD5 hash:	16ff3a934cc31ee7e4407caed8b5160b
humanhash:	table-uniform-kilo-comet
File name:	Compensation-1636332621-09272021.xls
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	129'024 bytes
First seen:	2021-09-27 15:12:45 UTC
Last seen:	Never
File type:	xls
MIME type:	application/vnd.ms-excel
ssdeep	3072:Cik3hOdsylKlgxopeiBNhZFGzE+cL2kdAnc6YehWfG+tUHKGDbpmsiiTBti2JtqV:vk3hOdsylKlgxopeiBNhZF+E+W2kdAnC
TLSH	T130C3AD463797C98BE94913398EE3869B3B72BC20DE72470332457F0E4EB96A18D16653
Reporter	abuse_ch
Tags:	1632729661 obama104 Qakbot qbot Quakbot xls

abuse_ch

Quakbot payload URLs:
http://185.250.148.213/44466.7053340278.dat
http://185.183.96.67/44466.7053340278.dat
http://190.14.37.178/44466.7053340278.dat

Quakbot C2s:
95.77.223.148:443
47.22.148.6:443
89.101.97.139:443
27.223.92.142:995
120.151.47.189:443
136.232.34.70:443
120.150.218.241:995
185.250.148.74:443
181.118.183.94:443
140.82.49.12:443
67.165.206.193:993
103.148.120.144:443
71.74.12.34:443
76.25.142.196:443
73.151.236.31:443
173.21.10.71:2222
75.188.35.168:443
2.178.88.145:61202
71.80.168.245:443
45.46.53.140:2222
109.12.111.14:443
105.198.236.99:443
73.77.87.137:443
41.248.239.221:995
182.176.112.182:443
96.37.113.36:993
75.66.88.33:443
162.244.227.34:443
24.229.150.54:995
216.201.162.158:443
92.59.35.196:2222
196.218.227.241:995
24.139.72.117:443
68.207.102.78:443
72.252.201.69:443
2.188.27.77:443
177.130.82.197:2222
68.204.7.158:443
189.210.115.207:443
181.163.96.53:443
24.55.112.61:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443
24.152.219.253:995
50.29.166.232:995

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 10

OLE dump

MalwareBazaar was able to identify 21 sections in this file using oledump:

Section ID	Section size	Section name
1	108 bytes	CompObj
2	244 bytes	DocumentSummaryInformation
3	208 bytes	SummaryInformation
4	101831 bytes	Workbook
5	662 bytes	_VBA_PROJECT_CUR/PROJECT
6	30 bytes	_VBA_PROJECT_CUR/PROJECTlk
7	116 bytes	_VBA_PROJECT_CUR/PROJECTwm
8	97 bytes	_VBA_PROJECT_CUR/UserForm2/CompObj
9	302 bytes	_VBA_PROJECT_CUR/UserForm2/VBFrame
10	226 bytes	_VBA_PROJECT_CUR/UserForm2/f
11	272 bytes	_VBA_PROJECT_CUR/UserForm2/o
12	4241 bytes	_VBA_PROJECT_CUR/VBA/Module5
13	991 bytes	_VBA_PROJECT_CUR/VBA/Sheet1
14	2501 bytes	_VBA_PROJECT_CUR/VBA/ThisWorkbook
15	1182 bytes	_VBA_PROJECT_CUR/VBA/UserForm2
16	4332 bytes	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
17	2461 bytes	_VBA_PROJECT_CUR/VBA/__SRP_0
18	138 bytes	_VBA_PROJECT_CUR/VBA/__SRP_1
19	264 bytes	_VBA_PROJECT_CUR/VBA/__SRP_2
20	256 bytes	_VBA_PROJECT_CUR/VBA/__SRP_3
21	1047 bytes	_VBA_PROJECT_CUR/VBA/dir

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	auto_open	Runs when the Excel Workbook is opened
AutoExec	auto_close	Runs when the Excel Workbook is closed
IOC	190.14.37.178	IPv4 address
IOC	185.183.96.67	IPv4 address
IOC	185.250.148.213	IPv4 address
Suspicious	Run	May run an executable file or a system command
Suspicious	EXEC	May run an executable file or a system
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

315

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Compensation-1636332621-09272021.xls

Verdict:

Malicious activity

Analysis date:

2021-09-27 15:13:08 UTC

Tags:

macros macros-on-open macros-on-close

Link:

https://app.any.run/tasks/7a46af3f-2845-4504-89b0-2353cc77f61e

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

File type:

application/vnd.ms-excel

Has a screenshot:

False

Contains macros:

True

Detection:

QakBot

Link:

https://www.capesandbox.com/analysis/192173/

Detection(s):

TwinWave.EvilDoc.AutoTriggerEvilMrFantasyM3.20200721.UNOFFICIAL

TwinWave.EvilDoc.QakVBA2XLMUndertheBridge.20210921.UNOFFICIAL

TwinWave.EvilDoc.WelcomeBackQakyHolidayRoad.20210920.UNOFFICIAL

Result

Verdict:

Malicious

File Type:

Legacy Excel File with Macro

Link:

https://app.docguard.net/7b9347900e27559ba3fcfe186a57ee8d28f8c949442a5d12a4bf9f7ed459114d/results/dashboard

Document image

Image:

Download PNG

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/7b9347900e27559ba3fcfe186a57ee8d28f8c949442a5d12a4bf9f7ed459114d

Details

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

IPv4 Dotted Quad URL

A URL was detected referencing a direct IP address, as opposed to a domain name.

Macro Contains Suspicious String

Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7b9347900e27559ba3fcfe186a57ee8d28f8c949442a5d12a4bf9f7ed459114d/

Threat name:

Document-Office.Downloader.SLoad

Status:

Malicious

First seen:

2021-09-27 15:13:06 UTC

AV detection:

1 of 45 (2.22%)

Threat level:

3/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=pojupeaoe5kzxi747ymguv7oruuprskjiqvf2evex6px5vczcfgq._file

Result

Malware family:

n/a

Score:

10/10

Tags:

macro macro_on_action

Link:

https://tria.ge/reports/210927-slrmtahdbl/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Process spawned unexpected child process

Malware Config

Dropper Extraction:

http://190.14.37.178/44466.6342006944.dat
http://185.183.96.67/44466.6342006944.dat
http://185.250.148.213/44466.6342006944.dat
http://190.14.37.178/44466.6343003472.dat
http://185.183.96.67/44466.6343003472.dat
http://185.250.148.213/44466.6343003472.dat

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/7b9347900e27/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7b9347900e27559ba3fcfe186a57ee8d28f8c949442a5d12a4bf9f7ed459114d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	buerloader_halo_generated Create hunting rule
Author:	Halogen Generated Rule, Corsin Camichel

Rule name:	TA505_Maldoc_21Nov_2 Create hunting rule
Author:	Arkbird_SOLG
Description:	invitation (1).xls
Reference:	https://twitter.com/58_158_177_102/status/1197432303057637377