QakbotIOCS_04_13_2020

Qakbot doc urls, April 13 2020:

http://santagula.app/wp-content/themes/calliope/linear/444444.png
http://pastavadese.com/wp-content/themes/calliope/linear/444444.png
http://orbitdevelopers.com/wp-content/themes/calliope/linear/444444.png
http://studio.stavimmebel.org.ua/wp-content/themes/calliope/linear/444444.png
http://roqya-medecineprophetique.com/wp-content/themes/calliope/linear/444444.png
http://c.teamworx.ph/168/22/17932.png


Sandbox Run: https://app.any.run/tasks/79324313-406d-4949-a223-65cc68f10675

Document Hash: c70ec4030316b1ca16987501583785a11d683f4d404b600a63ef3c1e62419dde

Document is on VT or just pull from that sandbox run.

Looks like it'll be links in emails leading to compromised sites for distro today.