malware_traffic

2020-04-21 - URLs/hashes for Qakbot (Qbot) spx101 files

Apr 21st, 2020
1,437
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2020-04-21 (TUESDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX101, THE "/EVOLVING/" WAVE
  2.  
  3. URLS FOR THE INITIAL ZIP ARCHIVES:
  4.  
  5. - hxxps://51youqun[.]com/wp-content/plugins/apikey/evolving/22129.zip
  6. - hxxps://51youqun[.]com/wp-content/plugins/apikey/evolving/7517584/7517584.zip
  7. - hxxps://51youqun[.]com/wp-content/plugins/apikey/evolving/784889/784889.zip
  8. - hxxps://51youqun[.]com/wp-content/plugins/apikey/evolving/831827.zip
  9. - hxxps://aquahub[.]co[.]ke/wp-content/uploads/2020/04/evolving/2055830/2055830.zip
  10. - hxxps://aquahub[.]co[.]ke/wp-content/uploads/2020/04/evolving/463845.zip
  11. - hxxps://aquahub[.]co[.]ke/wp-content/uploads/2020/04/evolving/59118686/59118686.zip
  12. - hxxps://aquahub[.]co[.]ke/wp-content/uploads/2020/04/evolving/833047563.zip
  13. - hxxp://artgennesis[.]com/wp-content/uploads/2020/04/evolving/67614295.zip
  14. - hxxp://artgennesis[.]com/wp-content/uploads/2020/04/evolving/742328894.zip
  15. - hxxp://artgennesis[.]com/wp-content/uploads/2020/04/evolving/95343/95343.zip
  16. - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/25200.zip
  17. - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/323326862.zip
  18. - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/33241.zip
  19. - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/404964572.zip
  20. - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/613298184/613298184.zip
  21. - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/78805/78805.zip
  22. - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/88126880/88126880.zip
  23. - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/892558.zip
  24. - hxxp://Bretmartinconstructioninc[.]com/evolving/04086256.zip
  25. - hxxp://Bretmartinconstructioninc[.]com/evolving/0996134.zip
  26. - hxxp://Bretmartinconstructioninc[.]com/evolving/237784083.zip
  27. - hxxp://Bretmartinconstructioninc[.]com/evolving/85171077/85171077.zip
  28. - hxxps://coinpronetworks[.]com/wp-content/uploads/2020/04/evolving/0723752/0723752.zip
  29. - hxxps://coinpronetworks[.]com/wp-content/uploads/2020/04/evolving/89270/89270.zip
  30. - hxxps://dev[.]mills[.]app/wp-content/plugins/apikey/evolving/14352.zip
  31. - hxxps://dev[.]mills[.]app/wp-content/plugins/apikey/evolving/18292/18292.zip
  32. - hxxps://dev[.]mills[.]app/wp-content/plugins/apikey/evolving/82183661/82183661.zip
  33. - hxxps://fenimor[.]simplemediaworks[.]com/wp-content/plugins/apikey/evolving/08852.zip
  34. - hxxps://fenimor[.]simplemediaworks[.]com/wp-content/plugins/apikey/evolving/19392/19392.zip
  35. - hxxps://fenimor[.]simplemediaworks[.]com/wp-content/plugins/apikey/evolving/87182.zip
  36. - hxxps://fenimor[.]simplemediaworks[.]com/wp-content/plugins/apikey/evolving/906525.zip
  37. - hxxps://hairlovers[.]hu/wp-content/uploads/2020/04/evolving/204869183.zip
  38. - hxxps://hairlovers[.]hu/wp-content/uploads/2020/04/evolving/54032/54032.zip
  39. - hxxps://hairlovers[.]hu/wp-content/uploads/2020/04/evolving/85515660/85515660.zip
  40. - hxxps://hairlovers[.]hu/wp-content/uploads/2020/04/evolving/945634866/945634866.zip
  41. - hxxps://icshongkong[.]com/wp-content/uploads/2020/04/evolving/1034048/1034048.zip
  42. - hxxps://icshongkong[.]com/wp-content/uploads/2020/04/evolving/31084/31084.zip
  43. - hxxps://icshongkong[.]com/wp-content/uploads/2020/04/evolving/712611496.zip
  44. - hxxps://ileolaherbalcare[.]com[.]ng/wp-content/uploads/2020/04/evolving/10326.zip
  45. - hxxps://ileolaherbalcare[.]com[.]ng/wp-content/uploads/2020/04/evolving/11044836/11044836.zip
  46. - hxxps://ileolaherbalcare[.]com[.]ng/wp-content/uploads/2020/04/evolving/301543/301543.zip
  47. - hxxp://keckarangdadap[.]pekalongankab[.]go[.]id/wp-content/uploads/2020/04/evolving/98110.zip
  48. - hxxp://knowledgetime[.]co[.]in/wp-content/uploads/2020/04/evolving/42895/42895.zip
  49. - hxxp://knowledgetime[.]co[.]in/wp-content/uploads/2020/04/evolving/801311.zip
  50. - hxxp://knowledgetime[.]co[.]in/wp-content/uploads/2020/04/evolving/8234130/8234130.zip
  51. - hxxp://knowledgetime[.]co[.]in/wp-content/uploads/2020/04/evolving/8806876/8806876.zip
  52. - hxxps://lamaisongourmande[.]live/wp-content/uploads/2020/04/evolving/23128159.zip
  53. - hxxps://lamaisongourmande[.]live/wp-content/uploads/2020/04/evolving/241093858.zip
  54. - hxxps://male[.]profertil[.]ro/wp-content/uploads/2020/04/evolving/522812015/522812015.zip
  55. - hxxps://mister-site[.]xyz/wp-content/uploads/2020/04/evolving/02400.zip
  56. - hxxps://mister-site[.]xyz/wp-content/uploads/2020/04/evolving/118782708/118782708.zip
  57. - hxxps://mister-site[.]xyz/wp-content/uploads/2020/04/evolving/187892.zip
  58. - hxxps://mister-site[.]xyz/wp-content/uploads/2020/04/evolving/3635171.zip
  59. - hxxps://mister-site[.]xyz/wp-content/uploads/2020/04/evolving/847232/847232.zip
  60. - hxxps://mister-site[.]xyz/wp-content/uploads/2020/04/evolving/9904911.zip
  61. - hxxp://mrsphr[.]ir/wp-content/uploads/2020/04/evolving/42933.zip
  62. - hxxp://music919[.]com/evolving/09371/09371.zip
  63. - hxxp://music919[.]com/evolving/5865723/5865723.zip
  64. - hxxp://music919[.]com/evolving/6907331/6907331.zip
  65. - hxxp://music919[.]com/evolving/70181.zip
  66. - hxxp://naturecell[.]net/wp-content/uploads/2020/04/evolving/6706332/6706332.zip
  67. - hxxp://patrickunger[.]de/wp-content/uploads/2020/04/evolving/09280873.zip
  68. - hxxp://patrickunger[.]de/wp-content/uploads/2020/04/evolving/29987.zip
  69. - hxxp://patrickunger[.]de/wp-content/uploads/2020/04/evolving/345514.zip
  70. - hxxp://patrickunger[.]de/wp-content/uploads/2020/04/evolving/460911018.zip
  71. - hxxp://patrickunger[.]de/wp-content/uploads/2020/04/evolving/4648831.zip
  72. - hxxp://patrickunger[.]de/wp-content/uploads/2020/04/evolving/474082.zip
  73. - hxxps://quirkydogchews[.]com/wp-content/uploads/2020/04/evolving/56935122/56935122.zip
  74. - hxxp://robotbas[.]ru/evolving/689839/689839.zip
  75. - hxxp://robotbas[.]ru/evolving/89884958.zip
  76. - hxxps://soaringxx[.]com/evolving/2520309/2520309.zip
  77. - hxxps://soaringxx[.]com/evolving/48224/48224.zip
  78. - hxxps://soaringxx[.]com/evolving/497346/497346.zip
  79. - hxxps://soaringxx[.]com/evolving/89690125.zip
  80. - hxxps://subhexplore[.]com/wp-content/plugins/apikey/evolving/138865702.zip
  81. - hxxps://themenuz[.]com/wp-content/uploads/2020/04/evolving/366700765/366700765.zip
  82. - hxxps://themenuz[.]com/wp-content/uploads/2020/04/evolving/682228.zip
  83. - hxxps://themenuz[.]com/wp-content/uploads/2020/04/evolving/68343173/68343173.zip
  84. - hxxps://themenuz[.]com/wp-content/uploads/2020/04/evolving/810211749.zip
  85. - hxxps://themenuz[.]com/wp-content/uploads/2020/04/evolving/9073043/9073043.zip
  86. - hxxps://themenuz[.]com/wp-content/uploads/2020/04/evolving/992093.zip
  87. - hxxps://tianzi8[.]cn/wp-content/plugins/apikey/evolving/17951100.zip
  88. - hxxps://tianzi8[.]cn/wp-content/plugins/apikey/evolving/8525382.zip
  89. - hxxp://transformerspaintingandremodeling[.]com/wp-content/uploads/2020/04/evolving/09141214/09141214.zip
  90. - hxxp://transformerspaintingandremodeling[.]com/wp-content/uploads/2020/04/evolving/1515357/1515357.zip
  91. - hxxp://transformerspaintingandremodeling[.]com/wp-content/uploads/2020/04/evolving/3780643.zip
  92. - hxxp://transformerspaintingandremodeling[.]com/wp-content/uploads/2020/04/evolving/50211569.zip
  93. - hxxp://transformerspaintingandremodeling[.]com/wp-content/uploads/2020/04/evolving/5065098/5065098.zip
  94. - hxxp://transformerspaintingandremodeling[.]com/wp-content/uploads/2020/04/evolving/830915/830915.zip
  95. - hxxps://villette45[.]com/wp-content/uploads/2020/04/evolving/5329347/5329347.zip
  96. - hxxp://wzrysp[.]com/wp-content/uploads/2020/04/evolving/2019905/2019905.zip
  97. - hxxp://wzrysp[.]com/wp-content/uploads/2020/04/evolving/4799695/4799695.zip
  98. - hxxp://wzrysp[.]com/wp-content/uploads/2020/04/evolving/798343.zip
  99. - hxxps://zoodbaz[.]com/wp-content/uploads/2020/04/evolving/0901086/0901086.zip
  100. - hxxps://zoodbaz[.]com/wp-content/uploads/2020/04/evolving/39861/39861.zip
  101. - hxxps://zoodbaz[.]com/wp-content/uploads/2020/04/evolving/68510/68510.zip
  102. - hxxps://zoodbaz[.]com/wp-content/uploads/2020/04/evolving/76720/76720.zip
  103. - hxxps://zoodbaz[.]com/wp-content/uploads/2020/04/evolving/845467.zip
  104.  
  105. URLS FOR THE QAKBOT EXE FILES:
  106.  
  107. - NOTE: These were first noted by @lazyactivist192 on Twitter and posted at https://pastebin.com/LnrpaeCZ (see the link for more info)
  108. - hxxp://pickap[.]io/wp-content/uploads/2020/04/evolving/888888.png
  109. - hxxp://decons[.]vn/wp-content/uploads/2020/04/evolving/888888.png
  110. - hxxp://econspiracy[.]se/evolving/888888.png
  111. - hxxp://enlightened-education[.]com/wp-content/uploads/2020/04/evolving/888888.png
  112. - hxxp://kslanrung[.]com/evolving/888888.png
  113.  
  114. EXAMPLES OF DOWNLOADED ZIP ARCHIVES:
  115.  
  116. - 0395575b6fd67ebba91b5c5232db2005ec5e5b4435af926bad6d74716a79315b 5329347.zip
  117. - 2c951c606d44b9d1425468056656bd4f92fca341048297ea09eaefa1c009552e 845467.zip
  118. - 42cbe608d9f7a2dbac5c92713c05a716389f261446178949f475fd8331319fc9 830915.zip
  119. - 66a18dbe5a645357135b266807d36d9c195ba4714cc68c220ec2efec1ad7246a 17951100.zip
  120. - 699f4b8fb52061fdfaf430f9015f9a9a083d880510e8aba296d2a87e3263a128 04086256.zip
  121. - a3a975278cbd9d3b5262184bc8e0a4de8b676200a3cde7064d1f04951d39036c 09371.zip
  122.  
  123. EXAMPLES OF EXTRACTED WORD DOCS:
  124.  
  125. - 3248cb9185d1b59355dbf71cc9a401c273b71ae41475693bb076989feccd988a Judgement_042020_1932.doc
  126. - 3774c142ac2034ce16665989960279340665c76f89bc291a3532b2ab05f51c7b Judgement_042020_265.doc
  127. - 57be2068fef0bf0abc40fdaa812507cdc5154b1b4bee20b62399162a5a58feaf Judgement_042020_1025.doc
  128. - 923a334ab5faf01a8560e7daf698e45ff02a6ef0031a90132b6fbd87be1a2827 Judgement_042020_3.doc
  129. - b736dbbc2dafc2cbfc37345e5663f664166bc828acf095f951d36ce47cdf6cec Judgement_042020_38.doc
  130. - d92a02759efcd4b27ac9cc354ce8bf02ce397b378358fb7eb05362bb605ccb9d Judgement_042020_1895.doc
  131.  
  132. EXAMPLES OF QAKBOT EXE FILES (ALL 2,373,120 BYTES):
  133.  
  134. - 246b917ca3cce7e65d1ee7322169ea5e719b5ba2ba7b6bd12c699eab02508fe3 C:\Users\Public\tmpdir\file2.exe
  135. - 520a5a113e3363df543307facc07dd8a84d08cf6b399a009383000ac6cc60c46 C:\Users\Public\tmpdir\file2.exe
  136. - 5712686409e879f08b391ed1f344aeea00e05258708cbc2bd604169533be2a77 C:\Users\Public\tmpdir\file2.exe
  137. - 7a4f8aa724af7c101669159e7157b5c9a15bd4825d9b8c6ba5051d2c9c53d4b5 C:\Users\Public\tmpdir\file2.exe
  138. - a0597df92d546d03682389bf1eee1a6b5d22f7983920a12dc6ceb9e5c5f5d402 C:\Users\Public\tmpdir\file2.exe
  139. - ac61e3cf876910f6eb36f176c57dafe767fab4ca3d3a032b0c5a337bafec0aca C:\Users\Public\tmpdir\file2.exe
RAW Paste Data