✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Alert – Vidar Malware – Active IOCs

September 3, 2021
Rewterz

Rewterz Threat Advisory – CVE-2021-26439 – Microsoft Edge Security Vulnerability

September 5, 2021

Rewterz Threat Alert – Qakbot (Qbot) Active Campaign – IoCs

Severity

High

Analysis Summary

A massive maldoc campaign delivering the QakBot/QBot banking trojan is detected. Qakbot leverages advanced techniques to evade detection and hamper manual analysis of the threat. QakBot attacks typically include a malicious attachment to a phishing email. Often these are bare Microsoft Word or excel documents attached to the spam email. This particular campaign features an xls file that includes macros within the document. These macros execute a PowerShell script that then downloads the Qakbot payload from specific URLs. The attackers use a common tactic to lure the victim to enable macros: when the target downloads the file, it asks the target to enable editing and then enable content in order to view the document.

0Vtmt8MPMm1KJFwGYdC-hfFs3r_trMeop_RyOOydJL9fRYFyDxuywyEGKasksBwWa63tB_W65lyQ7NBcqNFFFb9W6Zcr48IO4UiQ8H33FXh879RSQa_946LC949ZJqitS3ZEBdla=s0
XzjzdvxwzTC9ZiJr5GN-wvyq5UAlW3pmqLQjJIvtEcMjRqw1BuGlwQcfkwqy73GZjJZYgfcOnlFEta0CLvHIPPUDqf7WWmEX3-k2-TBC8fr3TUtfUEUxSS2J0c7B-JyuWsunZF-n=s0

Impact

  • Unauthorized Code Execution
  • Financial Theft
  • Information theft

Indicators of Compromise

IP

  • 75[.]67[.]192[.]125
  • 24[.]179[.]77[.]236
  • 70[.]163[.]161[.]79
  • 72[.]240[.]200[.]181
  • 184[.]185[.]103[.]157
  • 78[.]63[.]226[.]32
  • 83[.]196[.]56[.]65
  • 95[.]77[.]223[.]148
  • 76[.]168[.]147[.]166
  • 105[.]198[.]236[.]99
  • 73[.]151[.]236[.]31
  • 64[.]121[.]114[.]87
  • 213[.]122[.]113[.]120
  • 97[.]69[.]160[.]4
  • 77[.]27[.]207[.]217
  • 105[.]198[.]236[.]101
  • 75[.]188[.]35[.]168
  • 31[.]4[.]242[.]233
  • 144[.]139[.]47[.]206
  • 173[.]21[.]10[.]71
  • 125[.]62[.]192[.]220
  • 83[.]110[.]109[.]155
  • 76[.]25[.]142[.]196
  • 195[.]12[.]154[.]8
  • 186[.]144[.]33[.]73
  • 67[.]165[.]206[.]193
  • 96[.]21[.]251[.]127
  • 149[.]28[.]98[.]196
  • 222[.]153[.]122[.]173
  • 71[.]199[.]192[.]62
  • 45[.]77[.]117[.]108
  • 45[.]46[.]53[.]140
  • 70[.]168[.]130[.]172
  • 45[.]32[.]211[.]207
  • 71[.]74[.]12[.]34
  • 82[.]12[.]157[.]95
  • 50[.]29[.]166[.]232
  • 209[.]210[.]187[.]52
  • 149[.]28[.]99[.]97
  • 109[.]12[.]111[.]14
  • 207[.]246[.]77[.]75
  • 68[.]186[.]192[.]69
  • 188[.]27[.]179[.]172
  • 189[.]222[.]59[.]177
  • 149[.]28[.]101[.]90
  • 98[.]192[.]185[.]86
  • 174[.]104[.]22[.]30
  • 189[.]210[.]115[.]207
  • 142[.]117[.]191[.]18
  • 68[.]204[.]7[.]158
  • 189[.]146[.]183[.]105
  • 92[.]59[.]35[.]196
  • 75[.]137[.]47[.]174
  • 213[.]60[.]147[.]140
  • 45[.]63[.]107[.]192
  • 24[.]229[.]150[.]54
  • 196[.]221[.]207[.]137
  • 86[.]220[.]60[.]247
  • 108[.]46[.]145[.]30
  • 193[.]248[.]221[.]184
  • 187[.]250[.]238[.]164
  • 197[.]45[.]110[.]165
  • 151[.]205[.]102[.]42
  • 2[.]7[.]116[.]188
  • 71[.]41[.]184[.]10
  • 195[.]43[.]173[.]70
  • 96[.]253[.]46[.]210
  • 106[.]250[.]150[.]98
  • 172[.]78[.]59[.]180
  • 24[.]139[.]72[.]117
  • 45[.]67[.]231[.]247
  • 90[.]65[.]234[.]26
  • 72[.]252[.]201[.]69
  • 83[.]110[.]103[.]152
  • 47[.]22[.]148[.]6
  • 175[.]143[.]92[.]16
  • 83[.]110[.]9[.]71
  • 100[.]2[.]20[.]137
  • 78[.]97[.]207[.]104
  • 46[.]149[.]81[.]250
  • 59[.]90[.]246[.]200
  • 144[.]202[.]38[.]185
  • 207[.]246[.]116[.]237
  • 80[.]227[.]5[.]69
  • 45[.]77[.]115[.]208
  • 125[.]63[.]101[.]62
  • 86[.]236[.]77[.]68
  • 109[.]106[.]69[.]138
  • 84[.]72[.]35[.]226
  • 71[.]163[.]222[.]223
  • 217[.]133[.]54[.]140
  • 98[.]252[.]118[.]134
  • 197[.]161[.]154[.]132
  • 96[.]37[.]113[.]36
  • 89[.]137[.]211[.]239
  • 27[.]223[.]92[.]142
  • 74[.]222[.]204[.]82
  • 24[.]152[.]219[.]253
  • 122[.]148[.]156[.]131
  • 156[.]223[.]110[.]23
  • 96[.]61[.]23[.]88
  • 144[.]139[.]166[.]18
  • 92[.]96[.]3[.]180
  • 202[.]185[.]166[.]181
  • 71[.]187[.]170[.]235
  • 76[.]94[.]200[.]148
  • 50[.]244[.]112[.]106
  • 71[.]63[.]120[.]101
  • 140[.]82[.]49[.]12
  • 24[.]122[.]166[.]173
  • 196[.]151[.]252[.]84
  • 81[.]214[.]126[.]173
  • 73[.]25[.]124[.]140
  • 202[.]188[.]138[.]162
  • 216[.]201[.]162[.]158
  • 47[.]196[.]213[.]73
  • 74[.]68[.]144[.]202
  • 136[.]232[.]34[.]70
  • 186[.]154[.]175[.]13
  • 69[.]58[.]147[.]82

Remediation

  • Block the threat indicators at their respective controls.
  • Seach for IOCs in your environment.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo