MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d021b75eef6267da4058fdbd61509df9bf6ef3a57c0d1f400e4dc777813589ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Quakbot


Vendor detections: 8


Maldoc score: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d021b75eef6267da4058fdbd61509df9bf6ef3a57c0d1f400e4dc777813589ac
SHA3-384 hash: f733cb4ba22dc25ead1d0dba2b314b7c51f47b2ac61645cebf59210cce488178bf20995e3e8497d4148f2d6c7d1aa3d4
SHA1 hash: d36ec522d8a28b461cb479cd7dbeae031dc13d9c
MD5 hash: 4f205d008daf67a72f2cc68194b1e4af
humanhash: cola-august-oven-illinois
File name:Service-Interrupt-59510755.xls
Download: download sample
Signature Quakbot
Create hunting rule
File size:141'312 bytes
First seen:2021-10-14 14:47:30 UTC
Last seen:Never
File type:Excel file xls
MIME type:application/vnd.ms-excel
ssdeep 3072:Ek3hOdsylKlgxopeiBNhZFGzE+cL2kdARc6YehWfGvtUHKGDbpmsii2+mZyAqgI8:Ek3hOdsylKlgxopeiBNhZF+E+W2kdARN
TLSH T14AD39D427797C95BE94803398ED3C7DB3B72FC21DE224703364A7B1E5E7A6A08C16652
Reporter abuse_ch
Tags:obama115 Qakbot qbot Quakbot xls


Avatar
abuse_ch
Quakbot payload URLs:
http://185.244.150.146/44483.7281086806.dat
http://178.23.190.242/44483.7281086806.dat
http://23.106.124.53/44483.7281086806.dat

Quakbot C2s:
91.178.126.51:995
220.255.25.28:2222
208.78.220.143:443
77.31.162.93:443
73.230.205.91:443
216.201.162.158:443
94.200.181.154:443
24.231.209.2:2222
89.137.52.44:443
140.82.49.12:443
65.100.174.110:32103
41.86.42.158:995
27.223.92.142:995
200.232.214.222:995
81.250.153.227:2222
217.17.56.163:465
122.60.71.201:995
120.150.218.241:995
41.228.22.180:443
69.30.186.190:443
78.179.137.102:995
188.50.47.23:995
81.241.252.59:2078
174.54.193.186:443
76.25.142.196:443
136.232.254.46:443
89.101.97.139:443
136.232.34.70:443
39.49.7.254:995
193.17.191.154:995
115.96.62.113:443
73.52.50.32:443
177.76.251.27:995
136.143.11.232:443
146.66.238.74:443
103.142.10.177:443
136.232.254.46:995
167.248.117.81:443
68.186.192.69:443
67.230.44.194:443
181.118.183.94:443
197.89.144.200:443
98.203.26.168:443
173.21.10.71:2222
199.27.127.129:443
93.48.58.123:2222
72.173.78.211:443
189.252.166.130:32101
103.148.120.144:443
63.143.92.99:995
37.210.152.224:995
67.165.206.193:993
45.46.53.140:2222
189.135.16.92:443
73.151.236.31:443
75.188.35.168:443
103.82.211.39:995
50.194.160.233:995
96.37.113.36:993
71.74.12.34:443
189.146.41.71:443
65.100.174.110:8443
47.40.196.233:2222
50.194.160.233:465
181.4.53.6:465
103.82.211.39:465
50.194.160.233:32100
72.252.201.69:995
65.100.174.110:443
68.204.7.158:443
187.156.169.68:443
189.147.159.42:443
201.68.60.118:995
24.139.72.117:443
109.12.111.14:443
24.229.150.54:995
78.105.213.151:995
24.55.112.61:443
2.222.167.138:443
85.60.147.26:2078
75.131.217.182:443
85.60.147.26:2222
39.52.209.173:995
37.117.191.19:2222
196.207.140.40:995
129.35.116.77:990
68.117.229.117:443
83.110.201.195:443
80.6.192.58:443
49.206.29.127:443
103.250.38.115:443
117.198.158.234:443
185.250.148.74:443
82.43.184.158:443
111.125.245.116:443
124.123.42.115:2222
103.82.211.39:993
24.119.214.7:443
82.178.55.68:443
173.22.178.66:443
187.149.255.245:443
72.252.32.47:443
24.231.209.2:8443
105.242.94.246:995
24.231.209.2:50000
24.231.209.2:1194
24.107.165.50:443
50.194.160.233:993
50.194.160.233:22
24.231.209.2:2083
24.231.209.2:2087
24.231.209.2:2078
24.231.209.2:6881
39.49.64.244:995
24.231.209.2:50001
24.231.209.2:32100
50.194.160.233:443
123.201.40.112:443
120.151.47.189:443
86.152.43.223:443
67.166.233.75:443
122.11.222.242:2222
187.250.159.104:443
75.66.88.33:443
73.77.87.137:443
66.216.193.114:443
96.57.188.174:2078
81.213.59.22:443
73.207.119.14:443
105.198.236.99:443
68.117.61.91:2222
109.177.115.85:995
41.86.42.158:443
197.90.242.92:61201
115.186.190.60:995
186.32.163.199:443
203.213.107.174:443
73.77.87.137:995
86.8.177.143:443
209.50.20.255:443

Office OLE Information

This malware samples appears to be an Office document. The following table provides more information about this document using oletools and oledump.

OLE id
Maldoc score: 8
OLE dump

MalwareBazaar was able to identify 30 sections in this file using oledump:

Section IDSection sizeSection name
1108 bytesCompObj
2244 bytesDocumentSummaryInformation
3184 bytesSummaryInformation
4102051 bytesWorkbook
597 bytes_VBA_PROJECT_CUR/Nolert/CompObj
6254 bytes_VBA_PROJECT_CUR/Nolert/VBFrame
7307 bytes_VBA_PROJECT_CUR/Nolert/f
8272 bytes_VBA_PROJECT_CUR/Nolert/o
9789 bytes_VBA_PROJECT_CUR/PROJECT
1030 bytes_VBA_PROJECT_CUR/PROJECTlk
11179 bytes_VBA_PROJECT_CUR/PROJECTwm
123019 bytes_VBA_PROJECT_CUR/VBA/Module1
132965 bytes_VBA_PROJECT_CUR/VBA/Module2
141095 bytes_VBA_PROJECT_CUR/VBA/Module3
152250 bytes_VBA_PROJECT_CUR/VBA/Module5
161177 bytes_VBA_PROJECT_CUR/VBA/Nolert
17991 bytes_VBA_PROJECT_CUR/VBA/Sheet1
183459 bytes_VBA_PROJECT_CUR/VBA/ThisWorkbook
194975 bytes_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
203091 bytes_VBA_PROJECT_CUR/VBA/__SRP_0
21174 bytes_VBA_PROJECT_CUR/VBA/__SRP_1
22265 bytes_VBA_PROJECT_CUR/VBA/__SRP_2
23256 bytes_VBA_PROJECT_CUR/VBA/__SRP_3
24405 bytes_VBA_PROJECT_CUR/VBA/__SRP_4
25406 bytes_VBA_PROJECT_CUR/VBA/__SRP_5
26170 bytes_VBA_PROJECT_CUR/VBA/__SRP_6
27156 bytes_VBA_PROJECT_CUR/VBA/__SRP_7
28170 bytes_VBA_PROJECT_CUR/VBA/__SRP_8
29156 bytes_VBA_PROJECT_CUR/VBA/__SRP_9
301111 bytes_VBA_PROJECT_CUR/VBA/dir
OLE vba

MalwareBazaar was able to extract and deobfuscate VBA script(s) the following information from OLE objects embedded in this file using olevba:

TypeKeywordDescription
AutoExecauto_openRuns when the Excel Workbook is opened
AutoExecauto_closeRuns when the Excel Workbook is closed
IOC185.244.150.146IPv4 address
IOC178.23.190.242IPv4 address
IOC23.106.124.53IPv4 address
SuspiciousRunMay run an executable file or a system command
SuspiciousHex StringsHex-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)
SuspiciousBase64 StringsBase64-encoded strings were detected, may be used to obfuscate strings (option --decode to see all)

Intelligence

File Origin
# of uploads :
1
# of downloads :
430
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Service-Interrupt-59510755.xls
Verdict:
Malicious activity
Analysis date:
2021-10-14 14:52:07 UTC
Tags:
macros macros-on-open macros-on-close
Link:
https://app.any.run/tasks/40d2e2ae-3ce5-475e-8ab0-82a5cda1fdf5

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
TwinWave.EvilDoc.DOCXSTRGOOD.HTTP
Create hunting rule

SecuriteInfo.com.VBS.Obfus-175.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.JJCCBB.210927.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD.REGISTER.211002.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.DOCXSTRGOOD..DAT.211002.UNOFFICIAL
Create hunting rule

TwinWave.EvilDoc.EvilDocQakyIsWacky2021104.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malicious
File Type:
Legacy Excel File with Macro
Link:
https://app.docguard.net/d021b75eef6267da4058fdbd61509df9bf6ef3a57c0d1f400e4dc777813589ac/results/dashboard
Payload URLs
URL
File name
185.244.150.146
Module5
Document image
Image:
Download PNG
Document image
Verdict:
Malicious
Threat level:
  10/10
Confidence:
80%
Tags:
macros macros-on-close macros-on-open
Link:
https://www.filescan.io/uploads/616843251c2d58ba7406875d/reports/764445d6-ca8b-4064-a327-b2f48164843d/overview
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/d021b75eef6267da4058fdbd61509df9bf6ef3a57c0d1f400e4dc777813589ac
Details
Macro with Startup Hook
Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d021b75eef6267da4058fdbd61509df9bf6ef3a57c0d1f400e4dc777813589ac/
Threat name:
Document-Excel.Downloader.SLoad
Create hunting rule
Status:
Malicious
First seen:
2021-10-14 14:48:08 UTC
AV detection:
9 of 45 (20.00%)
Threat level:
  3/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2aq3oxxpmjt5uqcy7w6wcue57g7w545fpqgr6qaojxdxpajvrgwa._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
macro macro_on_action
Link:
https://tria.ge/reports/211014-r6ey3shha7/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies Internet Explorer settings
Modifies registry class
Suspicious behavior: AddClipboardFormatListener
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Office loads VBA resources, possible macro or embedded object present
Process spawned unexpected child process
Malware Config
Dropper Extraction:
http://185.244.150.146/44483.6168396991.dat
http://178.23.190.242/44483.6168396991.dat
http://23.106.124.53/44483.6168396991.dat
http://185.244.150.146/44483.6169354167.dat
http://178.23.190.242/44483.6169354167.dat
http://23.106.124.53/44483.6169354167.dat
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/d021b75eef62/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d021b75eef6267da4058fdbd61509df9bf6ef3a57c0d1f400e4dc777813589ac

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:buerloader_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel
Rule name:TA505_Maldoc_21Nov_2
Create hunting rule
Author:Arkbird_SOLG
Description:invitation (1).xls
Reference:https://twitter.com/58_158_177_102/status/1197432303057637377
Rule name:zloader_halo_generated
Create hunting rule
Author:Halogen Generated Rule, Corsin Camichel

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Quakbot

Excel file xls d021b75eef6267da4058fdbd61509df9bf6ef3a57c0d1f400e4dc777813589ac

(this sample)

Quakbot

DLL dll 9ed8eed3972af2b36d24b8ef141e70bd06683aab7bdf269e5def578ddb252a22

  
URLhaus
https://urlhaus.abuse.ch/browse/tag/obama115/
  
Dropping
SHA256 9ed8eed3972af2b36d24b8ef141e70bd06683aab7bdf269e5def578ddb252a22
  
Dropping
MD5 7a8526de6fc42c853ff5d39df16995b2

Comments