Qakbot_05_1_2020

Qakbot spx110 began distributing a non test zip around 2:16 GMT

The VBS inside was a bit different.  Instead of having 6 urls inside that it used to download the stage1 exe, this VBS just dropped the stage1 exe.

ZIP hashes seen: 4af37b4b8a3553a66eaace1b1deb3f7e



IPs:
73.23.194.75:443
67.6.34.43:443
98.192.100.13:443
174.86.3.44:2222
184.167.2.251:2222
84.117.89.128:443
69.11.247.242:443
168.103.52.51:995
142.129.227.86:443
217.162.149.212:443
97.78.107.14:995
156.213.220.112:443
73.60.148.209:443
203.213.104.25:995
47.203.89.185:443
72.255.200.69:2222
24.228.7.174:443
74.135.85.117:443
86.124.111.91:443
71.69.128.2:2222
47.232.26.181:443
50.104.186.71:443
156.222.184.101:995
173.172.205.216:443
72.204.242.138:6881
72.231.224.122:2222
74.134.4.236:443
50.110.243.246:443
68.14.210.246:22
75.111.145.5:443
71.213.29.14:995
209.182.121.133:2222
47.146.169.85:443
5.13.33.56:995
188.25.114.153:443
188.24.42.150:443
80.14.209.42:2222
134.19.208.152:443
24.115.246.224:995
121.122.68.121:443
89.41.152.127:443
78.96.148.177:443
73.214.231.2:443
81.245.66.237:995
47.40.244.237:443
71.178.38.101:443
98.199.226.41:443
73.144.30.70:443
71.88.104.107:443
152.32.80.37:443
76.180.69.236:443
71.115.203.184:443
79.114.194.106:443
86.124.157.220:443
151.224.19.189:443
98.32.60.217:443
89.43.136.239:443
68.49.120.179:443
5.13.110.111:443
24.27.82.216:2222
88.240.134.83:443
188.25.230.80:443
65.131.113.150:995
173.175.29.210:443
72.183.129.56:443
78.96.190.54:443
89.137.162.193:443
72.204.242.138:443
188.212.133.137:995
208.93.202.49:443
72.132.249.144:995
46.102.79.55:443
86.122.7.89:443
92.253.27.216:443
72.214.55.147:995
72.36.59.46:2222
72.16.212.107:465
184.98.104.7:995
81.103.144.77:443
68.82.125.234:443
84.232.238.30:443
24.201.79.208:2078
72.204.242.138:80
72.204.242.138:2087
49.191.9.180:995
172.95.42.35:443
98.219.77.197:443
178.193.33.121:2222
1.40.42.4:443
72.204.242.138:53
68.39.177.147:995
50.108.212.180:443
184.57.17.74:443
47.41.3.40:443
58.108.188.231:443
72.142.106.198:995
199.241.223.66:443
47.136.224.60:443
72.29.181.77:2078
108.227.161.27:995
203.33.139.134:443
86.127.12.161:21
72.204.242.138:443
47.180.66.10:443
136.228.103.44:443
72.209.191.27:443
70.62.160.186:6883
184.180.157.203:2222
50.244.112.10:443
72.190.101.70:443
108.30.161.143:443
173.197.155.139:443
120.147.83.120:2222
94.176.128.176:443
98.11.113.211:443
96.37.113.36:443
24.184.5.251:2222
50.244.112.106:443
71.77.231.251:443
68.46.142.48:443
66.208.105.6:443
41.36.48.245:995
72.16.57.99:443
74.215.201.51:443
24.55.152.50:995
87.65.204.240:995
95.76.31.12:443
85.122.141.42:995
84.117.60.157:443
73.163.242.114:443
31.5.21.66:443
85.186.50.42:443
75.182.220.196:2222
108.30.125.94:443
70.174.3.241:443
47.202.98.230:443
173.173.68.41:443
73.210.114.187:443
75.82.228.209:443
76.170.77.99:443
72.204.242.138:32100
71.190.244.38:443
73.226.220.56:443
172.78.87.180:443
50.247.230.33:995
24.110.96.149:443
216.163.4.91:443
47.205.231.60:443
2.190.226.125:443
75.162.139.204:995

https://app.any.run/tasks/d4bec97b-de11-4c46-9558-58b12efd6677/