MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be86d22f93fbcd772b79861d1b63099f2ec998c1a4dcdba7bb32178f86014850. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Quakbot

Vendor detections: 7

Maldoc score: 10

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	be86d22f93fbcd772b79861d1b63099f2ec998c1a4dcdba7bb32178f86014850
SHA3-384 hash:	03e8dd1feb5eb06766bd33ba3fd755ebf16786db105cd6183ac1f70e82fc1e6c50f157f721faabac1128c565cbf8b376
SHA1 hash:	22db42616d61d26baf0192720006355b126ee804
MD5 hash:	73632d714d112d8b4142ff33b807cbe9
humanhash:	blossom-coffee-robert-missouri
File name:	CompensationClaim-1649828515-09282021.xls
Download:	download sample
Signature	Quakbot Create hunting rule
File size:	140'288 bytes
First seen:	2021-09-28 13:13:05 UTC
Last seen:	2021-09-28 14:06:43 UTC
File type:	xls
MIME type:	application/vnd.ms-excel
ssdeep	3072:Yk3hOdsylKlgxopeiBNhZFGzE+cL2kdAH11ScHlwFPYidH4C1TsNku0KRjkR+T99:Yk3hOdsylKlgxopeiBNhZF+E+W2kdAmi
TLSH	T164D38D563399E84AEB6C23350ED997E6372ABD15AE6347133108731E1DF52A0CE07B4E
Reporter	abuse_ch
Tags:	1632821932 obama105 Qakbot qbot Quakbot xls

abuse_ch

Quakbot payload URLs:
http://190.14.37.187/44467.6645570602.dat
http://94.140.112.126/44467.6645570602.dat
http://185.141.27.213/44467.6645570602.dat

Quakbot C2s:
120.151.47.189:443
41.228.22.180:443
39.52.241.3:995
199.27.127.129:443
216.201.162.158:443
136.232.34.70:443
196.217.156.63:995
120.150.218.241:995
95.77.223.148:443
185.250.148.74:443
181.118.183.94:443
105.198.236.99:443
140.82.49.12:443
37.210.152.224:995
89.101.97.139:443
81.241.252.59:2078
27.223.92.142:995
81.250.153.227:2222
73.151.236.31:443
47.22.148.6:443
122.11.220.212:2222
76.25.142.196:443
75.66.88.33:443
45.46.53.140:2222
173.25.166.81:443
103.148.120.144:443
173.21.10.71:2222
186.18.205.199:995
71.74.12.34:443
67.165.206.193:993
47.40.196.233:2222
68.204.7.158:443
24.229.150.54:995
109.12.111.14:443
177.130.82.197:2222
72.252.201.69:443
24.55.112.61:443
24.139.72.117:443
187.156.138.172:443
71.80.168.245:443
82.77.137.101:995
173.234.155.233:443
75.188.35.168:443
5.238.149.235:61202
73.77.87.137:443
182.176.112.182:443
96.37.113.36:993
162.244.227.34:443
92.59.35.196:2222
196.218.227.241:995
68.207.102.78:443
2.188.27.77:443
189.210.115.207:443
181.163.96.53:443
75.107.26.196:465
185.250.148.74:2222
68.186.192.69:443

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id

Maldoc score: 10

OLE dump

MalwareBazaar was able to identify 22 sections in this file using oledump:

Section ID	Section size	Section name
1	108 bytes	CompObj
2	244 bytes	DocumentSummaryInformation
3	208 bytes	SummaryInformation
4	111238 bytes	Workbook
5	698 bytes	_VBA_PROJECT_CUR/PROJECT
6	30 bytes	_VBA_PROJECT_CUR/PROJECTlk
7	140 bytes	_VBA_PROJECT_CUR/PROJECTwm
8	97 bytes	_VBA_PROJECT_CUR/UserForm2/CompObj
9	302 bytes	_VBA_PROJECT_CUR/UserForm2/VBFrame
10	226 bytes	_VBA_PROJECT_CUR/UserForm2/f
11	272 bytes	_VBA_PROJECT_CUR/UserForm2/o
12	1120 bytes	_VBA_PROJECT_CUR/VBA/Module1
13	3869 bytes	_VBA_PROJECT_CUR/VBA/Module5
14	991 bytes	_VBA_PROJECT_CUR/VBA/Sheet1
15	2393 bytes	_VBA_PROJECT_CUR/VBA/ThisWorkbook
16	1181 bytes	_VBA_PROJECT_CUR/VBA/UserForm2
17	4469 bytes	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
18	2476 bytes	_VBA_PROJECT_CUR/VBA/__SRP_0
19	146 bytes	_VBA_PROJECT_CUR/VBA/__SRP_1
20	170 bytes	_VBA_PROJECT_CUR/VBA/__SRP_2
21	156 bytes	_VBA_PROJECT_CUR/VBA/__SRP_3
22	1073 bytes	_VBA_PROJECT_CUR/VBA/dir

OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

Type	Keyword	Description
AutoExec	auto_open	Runs when the Excel Workbook is opened
AutoExec	auto_close	Runs when the Excel Workbook is closed
IOC	190.14.37.187	IPv4 address
IOC	94.140.112.126	IPv4 address
IOC	185.141.27.213	IPv4 address
Suspicious	Run	May run an executable file or a system command
Suspicious	EXEC	May run an executable file or a system
Suspicious	Hex Strings	Hex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
Suspicious	Base64 Strings	Base64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin

# of uploads :

# of downloads :

303

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

CompensationClaim-1649828515-09282021.xls

Verdict:

Malicious activity

Analysis date:

2021-09-28 13:18:54 UTC

Tags:

macros macros-on-open macros-on-close loader

Link:

https://app.any.run/tasks/9cd75379-c673-4c36-9de4-9b51727a7558

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

File type:

application/vnd.ms-excel

Has a screenshot:

False

Contains macros:

True

Detection(s):

TwinWave.EvilDoc.AutoTriggerEvilMrFantasyM3.20200721.UNOFFICIAL

TwinWave.EvilDoc.DOCXSTRGOOD.JJCCBB.210927.UNOFFICIAL

TwinWave.EvilDoc.QakVBA2XLMUndertheBridge.20210921.UNOFFICIAL

TwinWave.EvilDoc.WelcomeBackQakyHolidayRoad.20210920.UNOFFICIAL

Result

Verdict:

Malicious

File Type:

Legacy Excel File with Macro

Link:

https://app.docguard.net/be86d22f93fbcd772b79861d1b63099f2ec998c1a4dcdba7bb32178f86014850/results/dashboard

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/be86d22f93fbcd772b79861d1b63099f2ec998c1a4dcdba7bb32178f86014850

Details

Macro with Startup Hook

Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.

IPv4 Dotted Quad URL

A URL was detected referencing a direct IP address, as opposed to a domain name.

Macro Contains Suspicious String

Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/be86d22f93fbcd772b79861d1b63099f2ec998c1a4dcdba7bb32178f86014850/

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=x2dnel4t7pgxok3zqyorwyyjt4xmtggbutonxj53gily7bqbjbia._file

Result

Malware family:

n/a

Score:

10/10

Tags:

macro macro_on_action

Link:

https://tria.ge/reports/210928-qf5w5scbfj/

Behaviour

Checks processor information in registry

Enumerates system info in registry

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Office loads VBA resources, possible macro or embedded object present

Process spawned unexpected child process

Malware Config

Dropper Extraction:

http://190.14.37.187/44467.5508958333.dat
http://94.140.112.126/44467.5508958333.dat
http://185.141.27.213/44467.5508958333.dat
http://190.14.37.187/44467.6344121528.dat
http://94.140.112.126/44467.6344121528.dat
http://185.141.27.213/44467.6344121528.dat

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/be86d22f93fb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/be86d22f93fbcd772b79861d1b63099f2ec998c1a4dcdba7bb32178f86014850

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	TA505_Maldoc_21Nov_2 Create hunting rule
Author:	Arkbird_SOLG
Description:	invitation (1).xls
Reference:	https://twitter.com/58_158_177_102/status/1197432303057637377