Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 2020-04-21 (TUESDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX101, THE "/EVOLVING/" WAVE
- URLS FOR THE INITIAL ZIP ARCHIVES:
- - hxxps://51youqun[.]com/wp-content/plugins/apikey/evolving/22129.zip
- - hxxps://51youqun[.]com/wp-content/plugins/apikey/evolving/7517584/7517584.zip
- - hxxps://51youqun[.]com/wp-content/plugins/apikey/evolving/784889/784889.zip
- - hxxps://51youqun[.]com/wp-content/plugins/apikey/evolving/831827.zip
- - hxxps://aquahub[.]co[.]ke/wp-content/uploads/2020/04/evolving/2055830/2055830.zip
- - hxxps://aquahub[.]co[.]ke/wp-content/uploads/2020/04/evolving/463845.zip
- - hxxps://aquahub[.]co[.]ke/wp-content/uploads/2020/04/evolving/59118686/59118686.zip
- - hxxps://aquahub[.]co[.]ke/wp-content/uploads/2020/04/evolving/833047563.zip
- - hxxp://artgennesis[.]com/wp-content/uploads/2020/04/evolving/67614295.zip
- - hxxp://artgennesis[.]com/wp-content/uploads/2020/04/evolving/742328894.zip
- - hxxp://artgennesis[.]com/wp-content/uploads/2020/04/evolving/95343/95343.zip
- - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/25200.zip
- - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/323326862.zip
- - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/33241.zip
- - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/404964572.zip
- - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/613298184/613298184.zip
- - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/78805/78805.zip
- - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/88126880/88126880.zip
- - hxxps://blackrockgl[.]com/wp-content/uploads/2020/04/evolving/892558.zip
- - hxxp://Bretmartinconstructioninc[.]com/evolving/04086256.zip
- - hxxp://Bretmartinconstructioninc[.]com/evolving/0996134.zip
- - hxxp://Bretmartinconstructioninc[.]com/evolving/237784083.zip
- - hxxp://Bretmartinconstructioninc[.]com/evolving/85171077/85171077.zip
- - hxxps://coinpronetworks[.]com/wp-content/uploads/2020/04/evolving/0723752/0723752.zip
- - hxxps://coinpronetworks[.]com/wp-content/uploads/2020/04/evolving/89270/89270.zip
- - hxxps://dev[.]mills[.]app/wp-content/plugins/apikey/evolving/14352.zip
- - hxxps://dev[.]mills[.]app/wp-content/plugins/apikey/evolving/18292/18292.zip
- - hxxps://dev[.]mills[.]app/wp-content/plugins/apikey/evolving/82183661/82183661.zip
- - hxxps://fenimor[.]simplemediaworks[.]com/wp-content/plugins/apikey/evolving/08852.zip
- - hxxps://fenimor[.]simplemediaworks[.]com/wp-content/plugins/apikey/evolving/19392/19392.zip
- - hxxps://fenimor[.]simplemediaworks[.]com/wp-content/plugins/apikey/evolving/87182.zip
- - hxxps://fenimor[.]simplemediaworks[.]com/wp-content/plugins/apikey/evolving/906525.zip
- - hxxps://hairlovers[.]hu/wp-content/uploads/2020/04/evolving/204869183.zip
- - hxxps://hairlovers[.]hu/wp-content/uploads/2020/04/evolving/54032/54032.zip
- - hxxps://hairlovers[.]hu/wp-content/uploads/2020/04/evolving/85515660/85515660.zip
- - hxxps://hairlovers[.]hu/wp-content/uploads/2020/04/evolving/945634866/945634866.zip
- - hxxps://icshongkong[.]com/wp-content/uploads/2020/04/evolving/1034048/1034048.zip
- - hxxps://icshongkong[.]com/wp-content/uploads/2020/04/evolving/31084/31084.zip
- - hxxps://icshongkong[.]com/wp-content/uploads/2020/04/evolving/712611496.zip
- - hxxps://ileolaherbalcare[.]com[.]ng/wp-content/uploads/2020/04/evolving/10326.zip
- - hxxps://ileolaherbalcare[.]com[.]ng/wp-content/uploads/2020/04/evolving/11044836/11044836.zip
- - hxxps://ileolaherbalcare[.]com[.]ng/wp-content/uploads/2020/04/evolving/301543/301543.zip
- - hxxp://keckarangdadap[.]pekalongankab[.]go[.]id/wp-content/uploads/2020/04/evolving/98110.zip
- - hxxp://knowledgetime[.]co[.]in/wp-content/uploads/2020/04/evolving/42895/42895.zip
- - hxxp://knowledgetime[.]co[.]in/wp-content/uploads/2020/04/evolving/801311.zip
- - hxxp://knowledgetime[.]co[.]in/wp-content/uploads/2020/04/evolving/8234130/8234130.zip
- - hxxp://knowledgetime[.]co[.]in/wp-content/uploads/2020/04/evolving/8806876/8806876.zip
- - hxxps://lamaisongourmande[.]live/wp-content/uploads/2020/04/evolving/23128159.zip
- - hxxps://lamaisongourmande[.]live/wp-content/uploads/2020/04/evolving/241093858.zip
- - hxxps://male[.]profertil[.]ro/wp-content/uploads/2020/04/evolving/522812015/522812015.zip
- - hxxps://mister-site[.]xyz/wp-content/uploads/2020/04/evolving/02400.zip
- - hxxps://mister-site[.]xyz/wp-content/uploads/2020/04/evolving/118782708/118782708.zip
- - hxxps://mister-site[.]xyz/wp-content/uploads/2020/04/evolving/187892.zip
- - hxxps://mister-site[.]xyz/wp-content/uploads/2020/04/evolving/3635171.zip
- - hxxps://mister-site[.]xyz/wp-content/uploads/2020/04/evolving/847232/847232.zip
- - hxxps://mister-site[.]xyz/wp-content/uploads/2020/04/evolving/9904911.zip
- - hxxp://mrsphr[.]ir/wp-content/uploads/2020/04/evolving/42933.zip
- - hxxp://music919[.]com/evolving/09371/09371.zip
- - hxxp://music919[.]com/evolving/5865723/5865723.zip
- - hxxp://music919[.]com/evolving/6907331/6907331.zip
- - hxxp://music919[.]com/evolving/70181.zip
- - hxxp://naturecell[.]net/wp-content/uploads/2020/04/evolving/6706332/6706332.zip
- - hxxp://patrickunger[.]de/wp-content/uploads/2020/04/evolving/09280873.zip
- - hxxp://patrickunger[.]de/wp-content/uploads/2020/04/evolving/29987.zip
- - hxxp://patrickunger[.]de/wp-content/uploads/2020/04/evolving/345514.zip
- - hxxp://patrickunger[.]de/wp-content/uploads/2020/04/evolving/460911018.zip
- - hxxp://patrickunger[.]de/wp-content/uploads/2020/04/evolving/4648831.zip
- - hxxp://patrickunger[.]de/wp-content/uploads/2020/04/evolving/474082.zip
- - hxxps://quirkydogchews[.]com/wp-content/uploads/2020/04/evolving/56935122/56935122.zip
- - hxxp://robotbas[.]ru/evolving/689839/689839.zip
- - hxxp://robotbas[.]ru/evolving/89884958.zip
- - hxxps://soaringxx[.]com/evolving/2520309/2520309.zip
- - hxxps://soaringxx[.]com/evolving/48224/48224.zip
- - hxxps://soaringxx[.]com/evolving/497346/497346.zip
- - hxxps://soaringxx[.]com/evolving/89690125.zip
- - hxxps://subhexplore[.]com/wp-content/plugins/apikey/evolving/138865702.zip
- - hxxps://themenuz[.]com/wp-content/uploads/2020/04/evolving/366700765/366700765.zip
- - hxxps://themenuz[.]com/wp-content/uploads/2020/04/evolving/682228.zip
- - hxxps://themenuz[.]com/wp-content/uploads/2020/04/evolving/68343173/68343173.zip
- - hxxps://themenuz[.]com/wp-content/uploads/2020/04/evolving/810211749.zip
- - hxxps://themenuz[.]com/wp-content/uploads/2020/04/evolving/9073043/9073043.zip
- - hxxps://themenuz[.]com/wp-content/uploads/2020/04/evolving/992093.zip
- - hxxps://tianzi8[.]cn/wp-content/plugins/apikey/evolving/17951100.zip
- - hxxps://tianzi8[.]cn/wp-content/plugins/apikey/evolving/8525382.zip
- - hxxp://transformerspaintingandremodeling[.]com/wp-content/uploads/2020/04/evolving/09141214/09141214.zip
- - hxxp://transformerspaintingandremodeling[.]com/wp-content/uploads/2020/04/evolving/1515357/1515357.zip
- - hxxp://transformerspaintingandremodeling[.]com/wp-content/uploads/2020/04/evolving/3780643.zip
- - hxxp://transformerspaintingandremodeling[.]com/wp-content/uploads/2020/04/evolving/50211569.zip
- - hxxp://transformerspaintingandremodeling[.]com/wp-content/uploads/2020/04/evolving/5065098/5065098.zip
- - hxxp://transformerspaintingandremodeling[.]com/wp-content/uploads/2020/04/evolving/830915/830915.zip
- - hxxps://villette45[.]com/wp-content/uploads/2020/04/evolving/5329347/5329347.zip
- - hxxp://wzrysp[.]com/wp-content/uploads/2020/04/evolving/2019905/2019905.zip
- - hxxp://wzrysp[.]com/wp-content/uploads/2020/04/evolving/4799695/4799695.zip
- - hxxp://wzrysp[.]com/wp-content/uploads/2020/04/evolving/798343.zip
- - hxxps://zoodbaz[.]com/wp-content/uploads/2020/04/evolving/0901086/0901086.zip
- - hxxps://zoodbaz[.]com/wp-content/uploads/2020/04/evolving/39861/39861.zip
- - hxxps://zoodbaz[.]com/wp-content/uploads/2020/04/evolving/68510/68510.zip
- - hxxps://zoodbaz[.]com/wp-content/uploads/2020/04/evolving/76720/76720.zip
- - hxxps://zoodbaz[.]com/wp-content/uploads/2020/04/evolving/845467.zip
- URLS FOR THE QAKBOT EXE FILES:
- - NOTE: These were first noted by @lazyactivist192 on Twitter and posted at https://pastebin.com/LnrpaeCZ (see the link for more info)
- - hxxp://pickap[.]io/wp-content/uploads/2020/04/evolving/888888.png
- - hxxp://decons[.]vn/wp-content/uploads/2020/04/evolving/888888.png
- - hxxp://econspiracy[.]se/evolving/888888.png
- - hxxp://enlightened-education[.]com/wp-content/uploads/2020/04/evolving/888888.png
- - hxxp://kslanrung[.]com/evolving/888888.png
- EXAMPLES OF DOWNLOADED ZIP ARCHIVES:
- - 0395575b6fd67ebba91b5c5232db2005ec5e5b4435af926bad6d74716a79315b 5329347.zip
- - 2c951c606d44b9d1425468056656bd4f92fca341048297ea09eaefa1c009552e 845467.zip
- - 42cbe608d9f7a2dbac5c92713c05a716389f261446178949f475fd8331319fc9 830915.zip
- - 66a18dbe5a645357135b266807d36d9c195ba4714cc68c220ec2efec1ad7246a 17951100.zip
- - 699f4b8fb52061fdfaf430f9015f9a9a083d880510e8aba296d2a87e3263a128 04086256.zip
- - a3a975278cbd9d3b5262184bc8e0a4de8b676200a3cde7064d1f04951d39036c 09371.zip
- EXAMPLES OF EXTRACTED WORD DOCS:
- - 3248cb9185d1b59355dbf71cc9a401c273b71ae41475693bb076989feccd988a Judgement_042020_1932.doc
- - 3774c142ac2034ce16665989960279340665c76f89bc291a3532b2ab05f51c7b Judgement_042020_265.doc
- - 57be2068fef0bf0abc40fdaa812507cdc5154b1b4bee20b62399162a5a58feaf Judgement_042020_1025.doc
- - 923a334ab5faf01a8560e7daf698e45ff02a6ef0031a90132b6fbd87be1a2827 Judgement_042020_3.doc
- - b736dbbc2dafc2cbfc37345e5663f664166bc828acf095f951d36ce47cdf6cec Judgement_042020_38.doc
- - d92a02759efcd4b27ac9cc354ce8bf02ce397b378358fb7eb05362bb605ccb9d Judgement_042020_1895.doc
- EXAMPLES OF QAKBOT EXE FILES (ALL 2,373,120 BYTES):
- - 246b917ca3cce7e65d1ee7322169ea5e719b5ba2ba7b6bd12c699eab02508fe3 C:\Users\Public\tmpdir\file2.exe
- - 520a5a113e3363df543307facc07dd8a84d08cf6b399a009383000ac6cc60c46 C:\Users\Public\tmpdir\file2.exe
- - 5712686409e879f08b391ed1f344aeea00e05258708cbc2bd604169533be2a77 C:\Users\Public\tmpdir\file2.exe
- - 7a4f8aa724af7c101669159e7157b5c9a15bd4825d9b8c6ba5051d2c9c53d4b5 C:\Users\Public\tmpdir\file2.exe
- - a0597df92d546d03682389bf1eee1a6b5d22f7983920a12dc6ceb9e5c5f5d402 C:\Users\Public\tmpdir\file2.exe
- - ac61e3cf876910f6eb36f176c57dafe767fab4ca3d3a032b0c5a337bafec0aca C:\Users\Public\tmpdir\file2.exe
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement