Qbot — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 3ce0e4d547a1783e…

MALICIOUS

Office (OOXML) / .XLSX

23.6 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300
MD5: ac3bf5a466978f41c7c42cf027105a19 SHA-1: 622261596950f36b5de71529365e8bbf9025f1c9 SHA-256: 3ce0e4d547a1783ef984248aafb1f98d8274adaafb987231984ca184305e6c77
60 Risk Score

Malware Insights

Qbot · confidence 90%

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious File: User Execution

The file is identified by ClamAV as 'Xls.Dropper.QbotDocu12020-9818439-0', strongly indicating it functions as a dropper for the Qbot banking trojan. The primary attack vector is likely spearphishing, leading the user to open the malicious Excel file and execute its payload. The SHA256 hash is included as a primary IOC.

Heuristics 1

  • ClamAV: Xls.Dropper.QbotDocu12020-9818439-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.QbotDocu12020-9818439-0

Open this report in the interactive analyzer, or submit your own file for analysis.