Qbot — Office (OOXML) / .XLSX malware analysis

Static analysis result for SHA-256 f027e2d3a8f228ca…

MALICIOUS

Office (OOXML) / .XLSX

21.4 KB Created: 2006-09-16 00:00:00 UTC Authoring application: Microsoft Excel 14.0300
MD5: d4cf163790f5ec83cabc6e268676526d SHA-1: 8d467e4d4817e583f0d8ecb6f1adcb3e88d56709 SHA-256: f027e2d3a8f228cae69eba5c09e12b991681a3b920c279b2577bb158df9d3848
60 Risk Score

Malware Insights

Qbot · confidence 95%

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment

The ClamAV heuristic 'Xls.Dropper.QbotDocu12020-9818439-0' strongly indicates this Excel file is a dropper for the Qbot banking trojan. Qbot is known to be distributed via malicious Office documents, often using social engineering to trick users into enabling macros. The file's metadata and verdict further support its malicious nature.

Heuristics 1

  • ClamAV: Xls.Dropper.QbotDocu12020-9818439-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Xls.Dropper.QbotDocu12020-9818439-0

Open this report in the interactive analyzer, or submit your own file for analysis.