2021-10-18 Qakbot IOCs

THREAT ATTRIBUTION:  QAKBOT

SUBJECTS OBSERVED
You got notification from DocuSign Signature Service
Your OneDrive File

SENDERS OBSERVED
GarySchwab@memic-haustechnik.de
manager@account.venomtviptv.com

MALDOC DOWNLOAD URLS
https://onedrive.live.com/download?cid=33030539479D636D&resid=33030539479D636D%21119&authkey=ANA2S4PNYkWcWXo&em=2
https://onedrive.live.com/download?cid=BCB6AC1FF7D22BB8&resid=BCB6AC1FF7D22BB8%21120&authkey=AHk7yB_sbUFL10o&em=2

EXCEL FILE HASHES
trend-3199441.xls
8b0ac08459238a7d97e5793f4215e384

trend-4317082.xls
231f1db25ec8409c0176035e2d556fa3

PAYLOAD DOWNLOAD URLS
https://samtnpy.org/bveCGKTX/ghb.html
https://massngo.org/dXKvyKV9v8c/ghb.html
https://vathiriyar.org/uy0Tk0keJUr/ghb.html

PAYLOAD FILE HASHES
I did not get any payload downloads.

QAKBOT C2s
Unknown 

SUPPORTING EVIDENCE
https://tria.ge/211018-s637cadgh3