QakbotIOCS_04_14_2020

Qakbot Distro URLS

http://millionsawesomeproducts.com/string/444444.png
http://common-factor.nl/string/444444.png
http://funpartyrent.com/string/444444.png
http://leukkado.be/string/444444.png
http://unik-evenements.fr/string/444444.png
http://d.teamworx.ph/1839/20/279.png

Seems it will be links in reply chains leading to zips with massive (38MB) VBS inside.

File was so large I couldn't upload it most places.
https://www.hybrid-analysis.com/sample/061554ce7104df515bf607c7f40b8128b6204d785b72e9768462ece10968734f/5e95c3e60fc9d443f20aac54

Zip AnyRun: https://app.any.run/tasks/720ac137-19a9-4d0f-8f59-dbb271cda69e