2020-09-08 Qakbot IOCs

Qakbot
======
Complaint_Letter_290270827_09072020.zip
8cb052014dc2d99741be83951ee7b654

Complaint_Letter_290270827_09072020.doc
ffb4cc84f20d1d8c394335cf444fd6fe

Losters.cmd
14d0600c1ca47a14831f463b9c304367

55555555.png
6763bd6eaec33e182e9befe5e5c10b70


Opening the Word Document drops the following file:
C:\drivers\Losters.cmd file

It then tries to download from:
http://talantinua.com/apawn/55555555.png
http://dellenbene.de/wpfsjfcrp/55555555.png
http://www.pauwstoffering.nl/pqwwmqzgjot/55555555.png
http://acrinetshop.com.br/arnphkv/55555555.png
http://www.corbettasalvatore.com/bolcv/55555555.png
http://lojacorpoemente.com.br/beuefuqpd/55555555.png
http://sulduzkhabar.ir/fhrhowc/55555555.png
http://hillsborobookkeeping.com/yowyvoux/55555555.png
http://evutt.ee/imjzrilmu/55555555.png
http://anawabighschool.com/lipun/55555555.png
http://www.serramentispada.it/odisaehjgg/55555555.png
http://papadeilumi.it/kupmmngtbbn/55555555.png
http://www.crippacostruzioni.it/jnatzwzp/55555555.png
http://emulatorgame.ir/ocdxvkhvmtjx/55555555.png

Supporting Evidence:
https://urlhaus.abuse.ch/url/455597/