MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 936762ac61ecd3ed975e97c2f8f328f62ecbc4ee2ef79c82943226a911751cc1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	936762ac61ecd3ed975e97c2f8f328f62ecbc4ee2ef79c82943226a911751cc1
SHA3-384 hash:	b5de247df7b0d634245454fb5da5b098d6ca7f5810d78294a46ecfa8c4952ca91aae5909c727a8042d6b6346a5bab5ac
SHA1 hash:	3faf5cd7a3e3e9787dda9517992aa3227b02cae8
MD5 hash:	7d1c096cba6d86a3d75727af5fa28c62
humanhash:	michigan-floor-arizona-mockingbird
File name:	ComplianceRep-840559179-Apr-18.zip
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	1'416'402 bytes
First seen:	2022-04-19 02:23:28 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24576:SUOpY0o6S7/ctm6Uc5Vq2JIDkqSgCJ5Iw1URhRW5D2+yAoUmqdn6wY+nebrOEMW2:SnpvSrpMnq4skngCJWw1URhEp2+zmGnx
TLSH	T1846533C0AFC3D666B98439BEA4C8EAFC81A32747E6660D7B053F0585715C1F2E8D60B5
TrID	80.0% (.ZIP) ZIP compressed archive (4000/1) 20.0% (.PG/BIN) PrintFox/Pagefox bitmap (640x800) (1000/1)
Reporter	malware_traffic
Tags:	excel obama176 Qakbot qbot Quakbot xlsb zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

368

Origin country :

n/a

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Heur.6424.17163.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.XLSBLOLBINHammerToFall.20210414.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.PDATARootDown.20210908.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.QakysLoveOpensTheDoor.M2.20211223.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Excel File with Excel4Macro

Link:

https://app.docguard.net/936762ac61ecd3ed975e97c2f8f328f62ecbc4ee2ef79c82943226a911751cc1/results/dashboard

Payload URLs

URL

File name

5.254.118.198

sharedStrings.bin

Document image

Image:

Download PNG

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

dridex macros-on-open regsvr32 regsvr32.exe

Link:

https://www.filescan.io/uploads/625e1d44482f2f41cacec3f2/reports/a3d21110-b67d-43d9-8345-a6a7295d072e/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/936762ac61ecd3ed975e97c2f8f328f62ecbc4ee2ef79c82943226a911751cc1

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/936762ac61ecd3ed975e97c2f8f328f62ecbc4ee2ef79c82943226a911751cc1/

ReversingLabs TitaniumCloud Document-Office.Backdoor.Quakbot

Threat name:

Document-Office.Backdoor.Quakbot

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-04-19 02:24:07 UTC

File Type:

Binary (Archive)

Extracted files:

35

AV detection:

7 of 42 (16.67%)

Threat level:

  5/5

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

n/a

Link:

https://tria.ge/reports/220419-cvpltabea3/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Process spawned unexpected child process

Malware Config

Dropper Extraction:

http://146.70.87.163/44666,6175321759.dat
http://5.254.118.198/44666,6175321759.dat
http://91.194.11.15/44666,6175321759.dat

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.74

Link:

https://yomi.yoroi.company/submissions/936762ac61ecd3ed975e97c2f8f328f62ecbc4ee2ef79c82943226a911751cc1