2020-04-15 - URLs/hashes for Qakbot (Qbot) spx97 files

2020-04-15 (WEDNESDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX97, THE "/BEADS/" WAVE

URLS FOR ZIP ARCHIVES:

- hxxp://aehezi[.]cn/wp-content/themes/calliope/beads/066395/066395.zip
- hxxp://aehezi[.]cn/wp-content/themes/calliope/beads/427426692/427426692.zip
- hxxp://aehezi[.]cn/wp-content/themes/calliope/beads/8639489.zip
- hxxp://aminach[.]co[.]il/wp-content/themes/calliope/beads/246943/246943.zip
- hxxps://www[.]aminach[.]co[.]il/wp-content/themes/calliope/beads/246943/246943.zip
- hxxp://aminach[.]co[.]il/wp-content/themes/calliope/beads/8843593.zip
- hxxps://anibatch[.]site/wp-content/themes/calliope/beads/85469711.zip
- hxxp://aryon[.]ihu[.]edu[.]tr/wp-content/themes/calliope/beads/1268346/1268346.zip
- hxxp://aryon[.]ihu[.]edu[.]tr/wp-content/themes/calliope/beads/174806.zip
- hxxp://aryon[.]ihu[.]edu[.]tr/wp-content/themes/calliope/beads/562840/562840.zip
- hxxp://aryon[.]ihu[.]edu[.]tr/wp-content/themes/calliope/beads/63425667.zip
- hxxps://asadairtravel[.]com/wp-content/themes/calliope/beads/063102/063102.zip
- hxxps://asadairtravel[.]com/wp-content/themes/calliope/beads/268431328.zip
- hxxp://blog[.]iwebnext[.]com/wp-content/themes/calliope/beads/012435.zip
- hxxp://blog[.]iwebnext[.]com/wp-content/themes/calliope/beads/27917092/27917092.zip
- hxxp://blog[.]iwebnext[.]com/wp-content/themes/calliope/beads/543816348.zip
- hxxp://blog[.]iwebnext[.]com/wp-content/themes/calliope/beads/743002/743002.zip
- hxxp://blog[.]iwebnext[.]com/wp-content/themes/calliope/beads/91175669/91175669.zip
- hxxp://blog[.]macwap[.]com/wp-content/themes/calliope/beads/2087961/2087961.zip
- hxxp://blog[.]macwap[.]com/wp-content/themes/calliope/beads/24732687.zip
- hxxps://blog[.]macwap[.]com/wp-content/themes/calliope/beads/24732687.zip
- hxxps://blog[.]macwap[.]com/wp-content/themes/calliope/beads/296847631/296847631.zip
- hxxps://blog[.]macwap[.]com/wp-content/themes/calliope/beads/739879.zip
- hxxps://blog[.]macwap[.]com/wp-content/themes/calliope/beads/739879.zip
- hxxp://blog[.]macwap[.]com/wp-content/themes/calliope/beads/9436868/9436868.zip
- hxxps://blog[.]macwap[.]com/wp-content/themes/calliope/beads/9436868/9436868.zip
- hxxps://blog[.]macwap[.]com/wp-content/themes/calliope/beads/97767/97767.zip
- hxxp://bodynutritioncare[.]com/wp-content/themes/calliope/beads/0617888.zip
- hxxps://bodynutritioncare[.]com/wp-content/themes/calliope/beads/0617888.zip
- hxxps://bodynutritioncare[.]com/wp-content/themes/calliope/beads/132803808/132803808.zip
- hxxps://www[.]bodynutritioncare[.]com/wp-content/themes/calliope/beads/132803808/132803808.zip
- hxxps://bodynutritioncare[.]com/wp-content/themes/calliope/beads/57041/57041.zip
- hxxp://brifing[.]info/wp-content/themes/calliope/beads/833036886.zip
- hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/017092580/017092580.zip
- hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/065919/065919.zip
- hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/4254115.zip
- hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/478404962/478404962.zip
- hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/589507371/589507371.zip
- hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/671003126.zip
- hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/992363.zip
- hxxps://businessadministration[.]win/wp-content/themes/calliope/beads/113130575.zip
- hxxps://businessadministration[.]win/wp-content/themes/calliope/beads/479539/479539.zip
- hxxps://businessadministration[.]win/wp-content/themes/calliope/beads/931464/931464.zip
- hxxp://dc-derma[.]gr/wp-content/themes/calliope/beads/28063186.zip
- hxxp://dc-derma[.]gr/wp-content/themes/calliope/beads/434541409.zip
- hxxp://www[.]dc-derma[.]gr/wp-content/themes/calliope/beads/434541409.zip
- hxxp://eclodtech[.]com/wp-content/themes/calliope/beads/55388454/55388454.zip
- hxxp://helpcube[.]net:443/wp-content/themes/calliope/beads/003513696.zip
- hxxps://helpcube[.]net/wp-content/themes/calliope/beads/25247550/25247550.zip
- hxxp://helpcube[.]net/wp-content/themes/calliope/beads/5292231.zip
- hxxps://hitdaspot[.]co[.]uk/beads/45987/45987.zip
- hxxps://hitdaspot[.]co[.]uk/beads/6919742.zip
- hxxps://hitdaspot[.]co[.]uk/beads/784468.zip
- hxxps://k-mart[.]co[.]in/wp-content/themes/calliope/beads/23250.zip
- hxxp://k-mart[.]co[.]in/wp-content/themes/calliope/beads/471187/471187.zip
- hxxps://k-mart[.]co[.]in/wp-content/themes/calliope/beads/471187/471187.zip
- hxxps://k-mart[.]co[.]in/wp-content/themes/calliope/beads/665484615/665484615.zip
- hxxps://k-mart[.]co[.]in/wp-content/themes/calliope/beads/805495.zip
- hxxps://k-mart[.]co[.]in/wp-content/themes/calliope/beads/97811303/97811303.zip
- hxxp://macassar900[.]com/wp-content/themes/calliope/beads/15424902/15424902.zip
- hxxp://www[.]macassar900[.]com/wp-content/themes/calliope/beads/15424902/15424902.zip
- hxxps://macassar900[.]com/wp-content/themes/calliope/beads/15424902/15424902.zip
- hxxps://www[.]macassar900[.]com/wp-content/themes/calliope/beads/15424902/15424902.zip
- hxxps://macassar900[.]com/wp-content/themes/calliope/beads/58558/58558.zip
- hxxps://www[.]macassar900[.]com/wp-content/themes/calliope/beads/58558/58558.zip
- hxxps://macassar900[.]com/wp-content/themes/calliope/beads/70540928.zip
- hxxps://www[.]macassar900[.]com/wp-content/themes/calliope/beads/70540928.zip
- hxxps://macassar900[.]com/wp-content/themes/calliope/beads/71223346.zip
- hxxps://www[.]macassar900[.]com/wp-content/themes/calliope/beads/71223346.zip
- hxxps://newsplustv[.]co[.]in/wp-content/themes/calliope/beads/07236596/07236596.zip
- hxxps://newsplustv[.]co[.]in/wp-content/themes/calliope/beads/15269843/15269843.zip
- hxxps://newsplustv[.]co[.]in/wp-content/themes/calliope/beads/165782309/165782309.zip
- hxxps://newsplustv[.]co[.]in/wp-content/themes/calliope/beads/26740.zip
- hxxp://ngoitruonghanhphuc[.]edu[.]vn/wp-content/plugins/advanced-ads-genesis/beads/14839121.zip
- hxxp://ngoitruonghanhphuc[.]edu[.]vn/wp-content/plugins/advanced-ads-genesis/beads/6581108.zip
- hxxps://nityantaproductions[.]com/wp-content/themes/calliope/beads/0965037.zip
- hxxp://pancoupe[.]com/wp-content/themes/calliope/beads/161162224.zip
- hxxp://pancoupe[.]com/wp-content/themes/calliope/beads/333490178/333490178.zip
- hxxps://pancoupe[.]com/wp-content/themes/calliope/beads/333490178/333490178.zip
- hxxp://pancoupe[.]com/wp-content/themes/calliope/beads/3626291.zip
- hxxp://pancoupe[.]com/wp-content/themes/calliope/beads/909171.zip
- hxxp://pawmarker[.]com/wp-content/themes/calliope/beads/452967/452967.zip
- hxxps://reclodtech[.]com/wp-content/themes/calliope/beads/339396795.zip
- hxxps://reclodtech[.]com/wp-content/themes/calliope/beads/485017/485017.zip
- hxxp://reclodtech[.]com/wp-content/themes/calliope/beads/691954755.zip
- hxxps://reclodtech[.]com/wp-content/themes/calliope/beads/87894159.zip
- hxxp://s1r[.]com/wp-content/themes/calliope/beads/44033/44033.zip
- hxxp://shaoxiaofei[.]cn/beads/07058857/07058857.zip
- hxxp://shaoxiaofei[.]cn/beads/11763.zip
- hxxp://shaoxiaofei[.]cn/beads/4487627/4487627.zip
- hxxp://shaoxiaofei[.]cn/beads/53170/53170.zip
- hxxp://shaoxiaofei[.]cn/beads/643205.zip
- hxxp://shaoxiaofei[.]cn/beads/80858358/80858358.zip
- hxxp://shaoxiaofei[.]cn/beads/95150115/95150115.zip
- hxxp://sportwin[.]com[.]ua/wp-content/themes/calliope/beads/534397705/534397705.zip
- hxxp://sportwin[.]com[.]ua/wp-content/themes/calliope/beads/82612240/82612240.zip
- hxxps://stationaryhome[.]com/wp-content/themes/calliope/beads/12698.zip
- hxxps://stationaryhome[.]com/wp-content/themes/calliope/beads/20161415/20161415.zip
- hxxps://stationaryhome[.]com/wp-content/themes/calliope/beads/8308538.zip
- hxxps://stationaryhome[.]com/wp-content/themes/calliope/beads/86397.zip
- hxxps://supera[.]com[.]br/wp-content/themes/calliope/beads/1952334.zip
- hxxps://www[.]supera[.]com[.]br/wp-content/themes/calliope/beads/1952334.zip
- hxxps://supera[.]com[.]br/wp-content/themes/calliope/beads/2321302/2321302.zip
- hxxps://www[.]supera[.]com[.]br/wp-content/themes/calliope/beads/2321302/2321302.zip
- hxxps://supera[.]com[.]br/wp-content/themes/calliope/beads/33185421.zip
- hxxps://www[.]supera[.]com[.]br/wp-content/themes/calliope/beads/33185421.zip
- hxxps://supera[.]com[.]br/wp-content/themes/calliope/beads/4339212.zip
- hxxps://www[.]supera[.]com[.]br/wp-content/themes/calliope/beads/4339212.zip
- hxxp://surecake[.]com/wp-content/themes/calliope/beads/5401407.zip
- hxxp://surecake[.]com/wp-content/themes/calliope/beads/803050873/803050873.zip
- hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/beads/023318/023318.zip
- hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/beads/182838/182838.zip
- hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/beads/2559243.zip
- hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/beads/73437.zip
- hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/beads/95011855/95011855.zip
- hxxp://tonytheworld[.]com/wp-content/themes/calliope/beads/1972835.zip
- hxxp://tonytheworld[.]com/wp-content/themes/calliope/beads/66346120.zip
- hxxp://wetechhub[.]com/wp-content/themes/calliope/beads/46724.zip
- hxxps://wetechhub[.]com/wp-content/themes/calliope/beads/46724.zip
- hxxps://wetechhub[.]com/wp-content/themes/calliope/beads/55248.zip
- hxxps://yeknam[.]com/blog/wp-content/themes/calliope/beads/293038301/293038301.zip
- hxxps://yeknam[.]com/blog/wp-content/themes/calliope/beads/302002161/302002161.zip
- hxxp://yeknam[.]com/blog/wp-content/themes/calliope/beads/4384750/4384750.zip
- hxxps://yeknam[.]com/blog/wp-content/themes/calliope/beads/4384750/4384750.zip
- hxxps://yeknam[.]com/blog/wp-content/themes/calliope/beads/503271/503271.zip
- hxxp://yeknam[.]com/blog/wp-content/themes/calliope/beads/593489/593489.zip
- hxxps://yeknam[.]com/blog/wp-content/themes/calliope/beads/5972191.zip

FOLLOW-UP URLS FOR QAKBOT EXE FILES

- NOTE: These were detected by @lazyactivist192 on Twitter and posted at https://pastebin.com/hYd6S8YT (see the link for more info)
- hxxp://bizzlon-realty[.]com/wp-content/themes/calliope/beads/444444.png
- hxxp://pakgt[.]com/wp-content/themes/calliope/beads/444444.png
- hxxp://marinerevetement[.]com/wp-content/themes/calliope/beads/444444.png
- hxxp://chattosport[.]com/wp-content/themes/calliope/beads/444444.png
- hxxp://a[.]coolbreeze[.]uk/213/312d/6748.png

EXAMPLES OF DOWNLOADED ZIP ARCHIVES

- 03623499d57c108ac0527658556c417422e7fc6409ff59d4f98771874fceb40e  02551515.zip
- 092ec5fd8aeafd8077ad7a5901295c9c4f406a27da67b1c578ca519663e6ebe2  5401407.zip
- 0c0995b99e3509cc87b494d9570cae4ee98a3ca3502276f9ffb9e50d99c2061d  9436868.zip
- 1d9c629436f3ebee59996de3c58bd1c54e66a3b1aeb5780e3f338374b373198a  15424902.zip
- 2577900063e21c12de8dc09e058b5af731d369fe1e18b8775f56404c5d2fba58  643205.zip
- 617931242c25e39e7a0a52f1e55adfd64ab5de2d66d5743009cf529b2dfd2aac  131773.zip
- 9ccf4953eaf4fbd80dcd1f92daa7953c992f9b2a07d132d87a86baffcd6e2b1d  203866920.zip
- a6e0824ebe9bf14edc2ef5eecb79132b2820dccf43e95cf3e341398785fa5add  5401407.zip
- b5456e11e14cfc29a4b74d32c0c7166152b4f0589687afdb306e53a6babbb391  452967.zip
- de0446e49f6a21893bdf3aed093a24dbeb84e51e2fe3a180d265d3d31eb8cbbd  513719.zip

EXAMPLES OF EXTRACTED WORD DOCS

- 049a7719851ee46a58967d2057d99f4de369da661aff93d2a9c4601f083a0abe  StockPurchaseAgreement_753.doc
- 05bc5e13fd05ab1c3847a18358cd52038cc8f9530d4492b5bd6994cfcb72f735  StockPurchaseAgreement_963.doc
- 092ec5fd8aeafd8077ad7a5901295c9c4f406a27da67b1c578ca519663e6ebe2  StockPurchaseAgreement_174.doc
- 0c90259363c211aadbfd4842f1f3687230f6307bc6fcad4bd9cb0191d6a2fad7  StockPurchaseAgreement_685.doc
- 2577900063e21c12de8dc09e058b5af731d369fe1e18b8775f56404c5d2fba58  StockPurchaseAgreement_963.doc
- 3406d8fd836ba35c75324f926432f264119836183c1f334fdb06fa6beb6cdbdc  StockPurchaseAgreement_253.doc
- 4c04b859ce63b241d6bda577cf255795f9af470c5f98c8ad3e5962cc85934378  StockPurchaseAgreement_924.doc
- 6158a8c61a4066c217171b8f3a3deb0548636105a8e1084a79cb24981f312ebc  StockPurchaseAgreement_269.doc
- 615f5e507f959cb2f460f7149206801c4da5c33c06ee894e9262d22e553b34a3  StockPurchaseAgreement_243.doc
- 680d3e1c250150543375aba2a893ee3320ea3e73fae6431b5d4a1c701e64ef30  StockPurchaseAgreement_737.doc
- 7f1a151d731865bca10b0f7e6b0cc861132857dc8cdd6cd741b07d541aa851a8  StockPurchaseAgreement_326.doc
- b29862599aec108e4ea783f76b87dd3640724ea41f5a3c992991edb62f13edd7  StockPurchaseAgreement_110.doc
- b86456bfec17ab0773c1e7c3a26ed41e66a5353a5eabe3bc48811586788bb977  StockPurchaseAgreement_956.doc

FOLLOW-UP QAKBOT EXE FILE:

- NOTE: This was detected by @lazyactivist192 on Twitter and posted at https://pastebin.com/hYd6S8YT (see the link for more info)
- 59c2576cc25bbf788268d2193498cdbe10efa7a224a857443c30f328593d3fc2  444444.png