API tools faq
paste
Advertisement
MalwareQuinn

Qakbot IOCs tr02 Dec 8 2020

MalwareQuinn
Dec 8th, 2020 (edited)
12,145
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.62 KB | None | 0 0
raw download clone embed print report
  1. Qakbot's affiliate tr02 began distributing their 061220.gif campaign today. Today's bins are loaded from rundll32.exe spawned from excel.exe, specifying the "DllRegisterServer" function. I threw some sheets into bazaar. the rest are in VT.
  2.  
  3. DUE TO SIZE LIMITATIONS, hashes will only be in OTX.
  4. https://otx.alienvault.com/pulse/5fcfd16b132cb76bf23b8294
  5.  
  6. Today's bin is signed by "PTM, spol. s r.o.".
  7. bot dll: https://bazaar.abuse.ch/sample/ef29e3458223c9b4cdfc03b3b9c228e517a26f3e7ea34d910d49c5e7cb7296ad/
  8.  
  9. IPs:
  10. 197.45.110.165:995
  11. 86.99.134.235:2222
  12. 174.76.21.134:443
  13. 208.99.100.129:443
  14. 86.126.198.195:443
  15. 185.105.131.233:443
  16. 85.132.36.111:2222
  17. 105.198.236.101:443
  18. 2.49.219.254:22
  19. 217.165.2.92:995
  20. 67.6.54.180:443
  21. 5.193.115.251:2222
  22. 83.196.50.197:2222
  23. 89.3.198.238:443
  24. 94.141.3.242:443
  25. 73.239.229.107:995
  26. 217.165.15.245:2222
  27. 68.225.60.77:995
  28. 85.121.42.12:443
  29. 99.240.226.2:443
  30. 98.4.227.199:443
  31. 85.186.122.190:443
  32. 41.205.16.108:443
  33. 187.213.199.54:443
  34. 189.250.59.212:2222
  35. 106.51.52.111:443
  36. 2.88.53.159:995
  37. 208.93.202.41:443
  38. 151.27.89.199:443
  39. 92.137.138.52:2222
  40. 173.70.165.101:995
  41. 89.33.87.107:443
  42. 108.46.145.30:443
  43. 118.160.162.127:443
  44. 187.213.136.249:995
  45. 94.53.92.42:443
  46. 80.106.85.24:2222
  47. 197.161.154.132:443
  48. 172.87.134.226:443
  49. 79.129.121.81:995
  50. 217.133.54.140:32100
  51. 67.8.103.21:443
  52. 74.135.112.78:443
  53. 118.70.55.146:443
  54. 86.97.221.121:443
  55. 87.27.110.90:2222
  56. 72.240.200.181:2222
  57. 196.151.252.84:443
  58. 209.137.209.158:443
  59. 94.49.157.35:443
  60. 67.61.157.208:443
  61. 151.60.163.18:443
  62. 47.44.217.98:443
  63. 73.51.245.231:995
  64. 174.29.203.226:993
  65. 178.222.114.132:995
  66. 83.110.19.27:443
  67. 156.213.155.74:443
  68. 98.115.243.237:443
  69. 83.202.68.220:2222
  70. 86.162.13.35:2222
  71. 109.115.125.81:50000
  72. 189.150.40.192:2222
  73. 200.75.136.78:443
  74. 92.154.83.96:2222
  75. 72.183.129.56:443
  76. 78.182.229.145:20
  77. 80.11.5.65:2222
  78. 85.204.189.105:443
  79. 189.141.31.12:443
  80. 81.97.154.100:443
  81. 199.116.241.147:443
  82. 206.183.190.53:993
  83. 50.60.166.59:995
  84. 47.22.148.6:443
  85. 116.240.78.45:995
  86. 75.109.180.221:443
  87. 213.67.45.195:2222
  88. 73.166.10.38:995
  89. 144.202.38.185:2222
  90. 144.202.38.185:995
  91. 90.101.117.122:2222
  92. 75.136.26.147:443
  93. 120.150.218.241:995
  94. 24.55.66.125:443
  95. 80.14.22.234:2222
  96. 94.49.188.240:443
  97. 173.197.22.90:2222
  98. 76.181.122.120:443
  99. 166.62.183.139:2078
  100. 72.36.59.46:2222
  101. 108.160.123.244:443
  102. 95.77.144.238:443
  103. 79.115.171.106:2222
  104. 78.181.19.134:443
  105. 41.105.41.202:443
  106. 85.60.132.8:2087
  107. 71.126.139.251:443
  108. 80.227.5.70:443
  109. 197.86.204.38:443
  110. 172.114.116.226:995
  111. 96.20.108.17:2222
  112. 2.90.33.130:443
  113. 50.244.112.106:443
  114. 174.76.11.123:995
  115. 185.126.13.190:995
  116. 72.29.181.78:2078
  117. 86.96.87.59:2078
  118. 91.104.44.226:995
  119. 173.245.152.231:443
  120. 92.99.22.32:443
  121. 39.36.30.92:995
  122. 216.201.162.158:443
  123. 173.169.189.169:443
  124. 93.113.177.152:443
  125. 108.190.151.108:2222
  126. 188.26.243.119:443
  127. 24.201.61.153:2078
  128. 149.28.99.97:2222
  129. 45.77.193.83:443
  130. 149.28.99.97:443
  131. 81.133.234.36:2222
  132. 95.76.27.6:443
  133. 72.204.242.138:443
  134. 69.123.234.175:443
  135. 45.63.107.192:2222
  136. 45.63.107.192:995
  137. 149.28.98.196:2222
  138. 149.28.98.196:995
  139. 149.28.98.196:443
  140. 109.205.204.229:2222
  141. 47.146.39.147:443
  142. 85.105.29.218:443
  143. 50.244.112.10:995
  144. 71.182.142.63:443
  145. 50.244.112.90:443
  146. 144.139.47.206:443
  147. 92.154.83.96:1194
  148. 176.45.233.94:995
  149. 86.245.87.251:2222
  150. 73.55.254.225:443
  151. 41.228.34.92:443
  152. 2.50.2.216:443
  153. 77.27.174.49:995
  154. 72.28.255.159:995
  155. 105.96.27.117:443
  156. 24.27.82.216:2222
  157. 100.12.74.21:995
  158. 95.77.223.148:443
  159. 24.95.61.62:443
  160.  
  161. urls:
  162. hxxp://kliksini[.]web[.]id/ds/061220[.]gif
  163. hxxps://starminimall[.]com/ds/061220[.]gif
  164. hxxp://gener8media[.]gi/ds/061220[.]gif
  165. hxxps://th[.]czonediver[.]com/ds/061220[.]gif
  166. hxxp://dahasa[.]danaweb[.]vn/ds/061220[.]gif
  167. hxxp://mempresariales[.]com/ds/061220[.]gif
  168. hxxps://barastea[.]com/ds/061220[.]gif
  169. hxxps://bucklindata[.]net/ds/061220[.]gif
  170.  
  171. SSDEEP sheet hashes:
  172. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgC:VcKoSsxzNDZLDZjlbR868O8KlVH3dswP
  173. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgG:VcKoSsxzNDZLDZjlbR868O8KlVH3dswn
  174. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgG:VcKoSsxzNDZLDZjlbR868O8KlVH3dswf
  175. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgr:VcKoSsxzNDZLDZjlbR868O8KlVH3dswG
  176. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgH:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw6
  177. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgC:VcKoSsxzNDZLDZjlbR868O8KlVH3dswz
  178. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dg3:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw6
  179. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgq:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw3
  180. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgW:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw7
  181. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgL:VcKoSsxzNDZLDZjlbR868O8KlVH3dswm
  182. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgK:VcKoSsxzNDZLDZjlbR868O8KlVH3dswP
  183. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgq:VcKoSsxzNDZLDZjlbR868O8KlVH3dswv
  184. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dge:VcKoSsxzNDZLDZjlbR868O8KlVH3dswD
  185. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgO:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw/
  186. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgO:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw7
  187. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgn:VcKoSsxzNDZLDZjlbR868O8KlVH3dswK
  188. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgS:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw/
  189. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dg2:VcKoSsxzNDZLDZjlbR868O8KlVH3dswb
  190. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgn:VcKoSsxzNDZLDZjlbR868O8KlVH3dswa
  191. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dg6:VcKoSsxzNDZLDZjlbR868O8KlVH3dswn
  192. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgS:VcKoSsxzNDZLDZjlbR868O8KlVH3dswj
  193. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgb:VcKoSsxzNDZLDZjlbR868O8KlVH3dswW
  194. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgm:VcKoSsxzNDZLDZjlbR868O8KlVH3dswH
  195. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgy:VcKoSsxzNDZLDZjlbR868O8KlVH3dswD
  196. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgX:VcKoSsxzNDZLDZjlbR868O8KlVH3dswa
  197. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgu:VcKoSsxzNDZLDZjlbR868O8KlVH3dswf
  198. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgG:VcKoSsxzNDZLDZjlbR868O8KlVH3dswL
  199. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgW:VcKoSsxzNDZLDZjlbR868O8KlVH3dswX
  200. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgX:VcKoSsxzNDZLDZjlbR868O8KlVH3dswi
  201. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dg7:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw2
  202. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgm:VcKoSsxzNDZLDZjlbR868O8KlVH3dswr
  203. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgP:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw+
  204. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dg3:VcKoSsxzNDZLDZjlbR868O8KlVH3dswK
  205. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dg+:VcKoSsxzNDZLDZjlbR868O8KlVH3dswj
  206. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgH:VcKoSsxzNDZLDZjlbR868O8KlVH3dswq
  207. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dge:VcKoSsxzNDZLDZjlbR868O8KlVH3dswr
  208. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgi:VcKoSsxzNDZLDZjlbR868O8KlVH3dswT
  209. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgz:VcKoSsxzNDZLDZjlbR868O8KlVH3dswe
  210. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgm:VcKoSsxzNDZLDZjlbR868O8KlVH3dswL
  211. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dg+:VcKoSsxzNDZLDZjlbR868O8KlVH3dswL
  212. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgX:VcKoSsxzNDZLDZjlbR868O8KlVH3dswq
  213. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgi:VcKoSsxzNDZLDZjlbR868O8KlVH3dswv
  214. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgz:VcKoSsxzNDZLDZjlbR868O8KlVH3dswC
  215. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgL:VcKoSsxzNDZLDZjlbR868O8KlVH3dswy
  216. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgO:VcKoSsxzNDZLDZjlbR868O8KlVH3dswT
  217. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgm:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw/
  218. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgj:VcKoSsxzNDZLDZjlbR868O8KlVH3dswu
  219. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgi:VcKoSsxzNDZLDZjlbR868O8KlVH3dswb
  220. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dge:VcKoSsxzNDZLDZjlbR868O8KlVH3dswv
  221. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgW:VcKoSsxzNDZLDZjlbR868O8KlVH3dswP
  222. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgH:VcKoSsxzNDZLDZjlbR868O8KlVH3dswa
  223. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgu:VcKoSsxzNDZLDZjlbR868O8KlVH3dswb
  224. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dg/:VcKoSsxzNDZLDZjlbR868O8KlVH3dswS
  225. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dg2:VcKoSsxzNDZLDZjlbR868O8KlVH3dswv
  226. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgC:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw7
  227. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dg+:VcKoSsxzNDZLDZjlbR868O8KlVH3dswP
  228. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dga:VcKoSsxzNDZLDZjlbR868O8KlVH3dswH
  229. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dga:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw/
  230. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dga:VcKoSsxzNDZLDZjlbR868O8KlVH3dswX
  231. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dg6:VcKoSsxzNDZLDZjlbR868O8KlVH3dswf
  232. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgy:VcKoSsxzNDZLDZjlbR868O8KlVH3dswf
  233. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dg2:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw3
  234. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgT:VcKoSsxzNDZLDZjlbR868O8KlVH3dsw+
  235. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgD:VcKoSsxzNDZLDZjlbR868O8KlVH3dswO
  236. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgy:VcKoSsxzNDZLDZjlbR868O8KlVH3dswL
  237. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgK:VcKoSsxzNDZLDZjlbR868O8KlVH3dswX
  238. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgS:VcKoSsxzNDZLDZjlbR868O8KlVH3dswr
  239. 3072:OScKoSsxzNDZLDZjlbR868O8KlVH3dswq7uDphYHceXVhca+fMHLtyeGxcl8/dgu:VcKoSsxzNDZLDZjlbR868O8KlVH3dswz
  240.  
  241.  
  242.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!