MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6ba8a487c1028f36f9bf7f4f85eb72041bfbac31eb6be2a35e58d588736020a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a6ba8a487c1028f36f9bf7f4f85eb72041bfbac31eb6be2a35e58d588736020a
SHA3-384 hash:	f55afcaf5573d03afb0d17bf06000ec53b53624ed49b4d9e905db1c1dfbb6f13d6cb489a1011d470aeae552052722d5d
SHA1 hash:	e501c5cab5dc6b426041880a935960aacb64f395
MD5 hash:	736b3818dc50e4dc23da9e52bd97e1dc
humanhash:	jersey-single-robin-romeo
File name:	alquuostas.xlsb
Download:	download sample
Signature	Quakbot Alert Create hunting rule
File size:	268'457 bytes
First seen:	2022-03-01 12:49:40 UTC
Last seen:	2022-03-01 15:11:21 UTC
File type:	xlsx
MIME type:	application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
ssdeep	6144:GjXuwmXNnZKKH4goy/pIGw7w/b1T/oJrjafmH3n0S:GjXWXNMKuy/aG6w/bp+iI3n0S
TLSH	T1BD440200B821A171CB35B97D61F2471202C11F15BB21C9C9336EADECAFB6DE72B959C6
Reporter	ankit_anubhav
Tags:	Quakbot xlsx

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

270

Origin country :

n/a

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

alquuostas.xlsb

Verdict:

Malicious activity

Analysis date:

2022-03-01 12:47:46 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/e9b938ce-e6c5-43fa-9d18-cd73fba5901c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

BitDam Malicious

Verdict:

Malicious

File type:

application/vnd.openxmlformats-officedocument.spreadsheetml.sheet

Has a screenshot:

False

Contains macros:

False

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/245799/

ClamAV Detected

Detection(s):

TwinWave.EvilDoc.XL4DataopItWasGoodLivingWithYou.20220118.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.XL4DataopItWasGoodLivingWithYou.20211109.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.DataOpGodGaveRockNRoll2U.20211215.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.XL4QakyFeaturingNothingNowhere.M2.20220215.UNOFFICIAL

Alert

Create hunting rule

TwinWave.EvilDoc.XL4QakyFeaturingNothingNowhere.M2.20210611.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Creating a window

Сreating synchronization primitives

DNS request

Creating a process with a hidden window

Sending an HTTP GET request

Sending a custom TCP request by exploiting the app vulnerability

Launching a process by exploiting the app vulnerability

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

OOXML Excel File with Excel4Macro

Link:

https://app.docguard.net/a6ba8a487c1028f36f9bf7f4f85eb72041bfbac31eb6be2a35e58d588736020a/results/dashboard

Payload URLs

URL

File name

https://optihealthwellness.com/20HtGYkXdys/fn.p

sharedStrings.bin

Document image

Image:

Download PNG

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

macros-on-open regsvr32 regsvr32.exe

Link:

https://www.filescan.io/uploads/621e167fdfdfa8501c7139ca/reports/59dca2df-44ba-449d-b1fe-e5492ffeda89/overview

inlyse Malware.AI Malicious

Label:

Malicious

Suspicious Score:

9.9/10

Score Malicious:

1%

Score Benign:

0%

Link:

https://www.malware.ai/gui/files/?id=dbff24a9-9f3b-4af1-9b59-001ab90ab850

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/a6ba8a487c1028f36f9bf7f4f85eb72041bfbac31eb6be2a35e58d588736020a

Details

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

Macro Execution Coercion

Detected a document that appears to social engineer the user into activating embedded logic.

Joe Sandbox Hidden Macro 4.0

Result

Threat name:

Hidden Macro 4.0

Alert

Create hunting rule

Detection:

malicious

Classification:

expl.evad

Score:

80 / 100

Link:

https://www.joesandbox.com/analysis/948174

Signature

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Found Excel 4.0 Macro with suspicious formulas

Found malicious Excel 4.0 Macro

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: Microsoft Office Product Spawning Windows Shell

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a6ba8a487c1028f36f9bf7f4f85eb72041bfbac31eb6be2a35e58d588736020a/

ReversingLabs TitaniumCloud Document-Office.Backdoor.Quakbot

Threat name:

Document-Office.Backdoor.Quakbot

Alert

Create hunting rule

Status:

Malicious

First seen:

2022-03-01 12:50:12 UTC

File Type:

Document

Extracted files:

35

AV detection:

14 of 27 (51.85%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=u25iusd4caupg343672pqxvxeba37owdd23l4krv4wgvrbzwaifa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  10/10

Tags:

macro xlm

Link:

https://tria.ge/reports/220301-p2x8rabfek/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Process spawned unexpected child process

Malware Config

Dropper Extraction:

https://optihealthwellness.com/20HtGYkXdys/fn.png
https://huigenbos-montage.nl/CxOxnOoTqPv/fn.png
https://milestonewriters.com/PQR7lz0kJGW/fn.png

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/a6ba8a487c1028f36f9bf7f4f85eb72041bfbac31eb6be2a35e58d588736020a

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

  

Delivery method

Distributed via e-mail link

Cape

https://www.capesandbox.com/analysis/245799/