2020-09-30 - Qakbot malspam example

Received: from [212.227.17.13] ([212.227.17.13:41711] helo=mout.kundenserver.de)
	by [removed] (envelope-from <legendre@handirect.com>)
	(ecelerity 4.2.38.62370 r(:)) with ESMTPS (cipher=DHE-RSA-AES256-GCM-SHA384
	subject="/C=DE/O=1&1 Internet SE/ST=Rheinland-Pfalz/L=Montabaur/CN=mout.kundenserver.de")
	id 78/C3-21529-D1AE47F5; Wed, 30 Sep 2020 16:27:10 -0400
Received: from localhost ([4.35.204.146]) by mrelayeu.kundenserver.de
 (mreue109 [212.227.15.184]) with ESMTPA (Nemesis) id 1MYNW8-1jtNs033xq-00VMaP
 for <admin@malware-traffic-analysis.net>; Wed, 30 Sep 2020 22:27:08 +0200
From: "[name removed]" <legendre@handirect.com>
Date: Wed, 30 Sep 2020 23:27:07 +0300
To: admin@malware-traffic-analysis.net
Subject: =?UTF-8?B?UmU6IFJlOiBQcm9qZWN0IHN0YXR1cyB1cGRhdGU=?=
MIME-Version: 1.0
X-Mailer: Microsoft Outlook 16.0
Content-Type: multipart/mixed; boundary=0e31d473551c1c25580b50a573e5690e
Message-ID: <1MhUDl-1ktDot1fOd-00eg5o@mrelayeu.kundenserver.de>

--0e31d473551c1c25580b50a573e5690e
Content-Type: text/html; charset=utf-8

<p>Good morning,</p><p>Check the document and let me know what you think about it.</p><p><br />Thanks.</p><br><blockquote type="cite">[email chain removed]


</blockquote>


--0e31d473551c1c25580b50a573e5690e
Content-Type: application/zip
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="=?UTF-8?B?MzE5ODY3OTA5MzYuemlw?="

[information removed, file available at: https://app.any.run/tasks/fd4a4da2-cd02-461f-a852-00431a2f33b0]

--0e31d473551c1c25580b50a573e5690e--