malware_traffic

2020-04-15 - URLs/hashes for Qakbot (Qbot) spx97 files

Apr 15th, 2020
1,168
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2020-04-15 (WEDNESDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX97, THE "/BEADS/" WAVE
  2.  
  3. URLS FOR ZIP ARCHIVES:
  4.  
  5. - hxxp://aehezi[.]cn/wp-content/themes/calliope/beads/066395/066395.zip
  6. - hxxp://aehezi[.]cn/wp-content/themes/calliope/beads/427426692/427426692.zip
  7. - hxxp://aehezi[.]cn/wp-content/themes/calliope/beads/8639489.zip
  8. - hxxp://aminach[.]co[.]il/wp-content/themes/calliope/beads/246943/246943.zip
  9. - hxxps://www[.]aminach[.]co[.]il/wp-content/themes/calliope/beads/246943/246943.zip
  10. - hxxp://aminach[.]co[.]il/wp-content/themes/calliope/beads/8843593.zip
  11. - hxxps://anibatch[.]site/wp-content/themes/calliope/beads/85469711.zip
  12. - hxxp://aryon[.]ihu[.]edu[.]tr/wp-content/themes/calliope/beads/1268346/1268346.zip
  13. - hxxp://aryon[.]ihu[.]edu[.]tr/wp-content/themes/calliope/beads/174806.zip
  14. - hxxp://aryon[.]ihu[.]edu[.]tr/wp-content/themes/calliope/beads/562840/562840.zip
  15. - hxxp://aryon[.]ihu[.]edu[.]tr/wp-content/themes/calliope/beads/63425667.zip
  16. - hxxps://asadairtravel[.]com/wp-content/themes/calliope/beads/063102/063102.zip
  17. - hxxps://asadairtravel[.]com/wp-content/themes/calliope/beads/268431328.zip
  18. - hxxp://blog[.]iwebnext[.]com/wp-content/themes/calliope/beads/012435.zip
  19. - hxxp://blog[.]iwebnext[.]com/wp-content/themes/calliope/beads/27917092/27917092.zip
  20. - hxxp://blog[.]iwebnext[.]com/wp-content/themes/calliope/beads/543816348.zip
  21. - hxxp://blog[.]iwebnext[.]com/wp-content/themes/calliope/beads/743002/743002.zip
  22. - hxxp://blog[.]iwebnext[.]com/wp-content/themes/calliope/beads/91175669/91175669.zip
  23. - hxxp://blog[.]macwap[.]com/wp-content/themes/calliope/beads/2087961/2087961.zip
  24. - hxxp://blog[.]macwap[.]com/wp-content/themes/calliope/beads/24732687.zip
  25. - hxxps://blog[.]macwap[.]com/wp-content/themes/calliope/beads/24732687.zip
  26. - hxxps://blog[.]macwap[.]com/wp-content/themes/calliope/beads/296847631/296847631.zip
  27. - hxxps://blog[.]macwap[.]com/wp-content/themes/calliope/beads/739879.zip
  28. - hxxps://blog[.]macwap[.]com/wp-content/themes/calliope/beads/739879.zip
  29. - hxxp://blog[.]macwap[.]com/wp-content/themes/calliope/beads/9436868/9436868.zip
  30. - hxxps://blog[.]macwap[.]com/wp-content/themes/calliope/beads/9436868/9436868.zip
  31. - hxxps://blog[.]macwap[.]com/wp-content/themes/calliope/beads/97767/97767.zip
  32. - hxxp://bodynutritioncare[.]com/wp-content/themes/calliope/beads/0617888.zip
  33. - hxxps://bodynutritioncare[.]com/wp-content/themes/calliope/beads/0617888.zip
  34. - hxxps://bodynutritioncare[.]com/wp-content/themes/calliope/beads/132803808/132803808.zip
  35. - hxxps://www[.]bodynutritioncare[.]com/wp-content/themes/calliope/beads/132803808/132803808.zip
  36. - hxxps://bodynutritioncare[.]com/wp-content/themes/calliope/beads/57041/57041.zip
  37. - hxxp://brifing[.]info/wp-content/themes/calliope/beads/833036886.zip
  38. - hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/017092580/017092580.zip
  39. - hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/065919/065919.zip
  40. - hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/4254115.zip
  41. - hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/478404962/478404962.zip
  42. - hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/589507371/589507371.zip
  43. - hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/671003126.zip
  44. - hxxps://bubbletechno[.]com/wp-content/themes/calliope/beads/992363.zip
  45. - hxxps://businessadministration[.]win/wp-content/themes/calliope/beads/113130575.zip
  46. - hxxps://businessadministration[.]win/wp-content/themes/calliope/beads/479539/479539.zip
  47. - hxxps://businessadministration[.]win/wp-content/themes/calliope/beads/931464/931464.zip
  48. - hxxp://dc-derma[.]gr/wp-content/themes/calliope/beads/28063186.zip
  49. - hxxp://dc-derma[.]gr/wp-content/themes/calliope/beads/434541409.zip
  50. - hxxp://www[.]dc-derma[.]gr/wp-content/themes/calliope/beads/434541409.zip
  51. - hxxp://eclodtech[.]com/wp-content/themes/calliope/beads/55388454/55388454.zip
  52. - hxxp://helpcube[.]net:443/wp-content/themes/calliope/beads/003513696.zip
  53. - hxxps://helpcube[.]net/wp-content/themes/calliope/beads/25247550/25247550.zip
  54. - hxxp://helpcube[.]net/wp-content/themes/calliope/beads/5292231.zip
  55. - hxxps://hitdaspot[.]co[.]uk/beads/45987/45987.zip
  56. - hxxps://hitdaspot[.]co[.]uk/beads/6919742.zip
  57. - hxxps://hitdaspot[.]co[.]uk/beads/784468.zip
  58. - hxxps://k-mart[.]co[.]in/wp-content/themes/calliope/beads/23250.zip
  59. - hxxp://k-mart[.]co[.]in/wp-content/themes/calliope/beads/471187/471187.zip
  60. - hxxps://k-mart[.]co[.]in/wp-content/themes/calliope/beads/471187/471187.zip
  61. - hxxps://k-mart[.]co[.]in/wp-content/themes/calliope/beads/665484615/665484615.zip
  62. - hxxps://k-mart[.]co[.]in/wp-content/themes/calliope/beads/805495.zip
  63. - hxxps://k-mart[.]co[.]in/wp-content/themes/calliope/beads/97811303/97811303.zip
  64. - hxxp://macassar900[.]com/wp-content/themes/calliope/beads/15424902/15424902.zip
  65. - hxxp://www[.]macassar900[.]com/wp-content/themes/calliope/beads/15424902/15424902.zip
  66. - hxxps://macassar900[.]com/wp-content/themes/calliope/beads/15424902/15424902.zip
  67. - hxxps://www[.]macassar900[.]com/wp-content/themes/calliope/beads/15424902/15424902.zip
  68. - hxxps://macassar900[.]com/wp-content/themes/calliope/beads/58558/58558.zip
  69. - hxxps://www[.]macassar900[.]com/wp-content/themes/calliope/beads/58558/58558.zip
  70. - hxxps://macassar900[.]com/wp-content/themes/calliope/beads/70540928.zip
  71. - hxxps://www[.]macassar900[.]com/wp-content/themes/calliope/beads/70540928.zip
  72. - hxxps://macassar900[.]com/wp-content/themes/calliope/beads/71223346.zip
  73. - hxxps://www[.]macassar900[.]com/wp-content/themes/calliope/beads/71223346.zip
  74. - hxxps://newsplustv[.]co[.]in/wp-content/themes/calliope/beads/07236596/07236596.zip
  75. - hxxps://newsplustv[.]co[.]in/wp-content/themes/calliope/beads/15269843/15269843.zip
  76. - hxxps://newsplustv[.]co[.]in/wp-content/themes/calliope/beads/165782309/165782309.zip
  77. - hxxps://newsplustv[.]co[.]in/wp-content/themes/calliope/beads/26740.zip
  78. - hxxp://ngoitruonghanhphuc[.]edu[.]vn/wp-content/plugins/advanced-ads-genesis/beads/14839121.zip
  79. - hxxp://ngoitruonghanhphuc[.]edu[.]vn/wp-content/plugins/advanced-ads-genesis/beads/6581108.zip
  80. - hxxps://nityantaproductions[.]com/wp-content/themes/calliope/beads/0965037.zip
  81. - hxxp://pancoupe[.]com/wp-content/themes/calliope/beads/161162224.zip
  82. - hxxp://pancoupe[.]com/wp-content/themes/calliope/beads/333490178/333490178.zip
  83. - hxxps://pancoupe[.]com/wp-content/themes/calliope/beads/333490178/333490178.zip
  84. - hxxp://pancoupe[.]com/wp-content/themes/calliope/beads/3626291.zip
  85. - hxxp://pancoupe[.]com/wp-content/themes/calliope/beads/909171.zip
  86. - hxxp://pawmarker[.]com/wp-content/themes/calliope/beads/452967/452967.zip
  87. - hxxps://reclodtech[.]com/wp-content/themes/calliope/beads/339396795.zip
  88. - hxxps://reclodtech[.]com/wp-content/themes/calliope/beads/485017/485017.zip
  89. - hxxp://reclodtech[.]com/wp-content/themes/calliope/beads/691954755.zip
  90. - hxxps://reclodtech[.]com/wp-content/themes/calliope/beads/87894159.zip
  91. - hxxp://s1r[.]com/wp-content/themes/calliope/beads/44033/44033.zip
  92. - hxxp://shaoxiaofei[.]cn/beads/07058857/07058857.zip
  93. - hxxp://shaoxiaofei[.]cn/beads/11763.zip
  94. - hxxp://shaoxiaofei[.]cn/beads/4487627/4487627.zip
  95. - hxxp://shaoxiaofei[.]cn/beads/53170/53170.zip
  96. - hxxp://shaoxiaofei[.]cn/beads/643205.zip
  97. - hxxp://shaoxiaofei[.]cn/beads/80858358/80858358.zip
  98. - hxxp://shaoxiaofei[.]cn/beads/95150115/95150115.zip
  99. - hxxp://sportwin[.]com[.]ua/wp-content/themes/calliope/beads/534397705/534397705.zip
  100. - hxxp://sportwin[.]com[.]ua/wp-content/themes/calliope/beads/82612240/82612240.zip
  101. - hxxps://stationaryhome[.]com/wp-content/themes/calliope/beads/12698.zip
  102. - hxxps://stationaryhome[.]com/wp-content/themes/calliope/beads/20161415/20161415.zip
  103. - hxxps://stationaryhome[.]com/wp-content/themes/calliope/beads/8308538.zip
  104. - hxxps://stationaryhome[.]com/wp-content/themes/calliope/beads/86397.zip
  105. - hxxps://supera[.]com[.]br/wp-content/themes/calliope/beads/1952334.zip
  106. - hxxps://www[.]supera[.]com[.]br/wp-content/themes/calliope/beads/1952334.zip
  107. - hxxps://supera[.]com[.]br/wp-content/themes/calliope/beads/2321302/2321302.zip
  108. - hxxps://www[.]supera[.]com[.]br/wp-content/themes/calliope/beads/2321302/2321302.zip
  109. - hxxps://supera[.]com[.]br/wp-content/themes/calliope/beads/33185421.zip
  110. - hxxps://www[.]supera[.]com[.]br/wp-content/themes/calliope/beads/33185421.zip
  111. - hxxps://supera[.]com[.]br/wp-content/themes/calliope/beads/4339212.zip
  112. - hxxps://www[.]supera[.]com[.]br/wp-content/themes/calliope/beads/4339212.zip
  113. - hxxp://surecake[.]com/wp-content/themes/calliope/beads/5401407.zip
  114. - hxxp://surecake[.]com/wp-content/themes/calliope/beads/803050873/803050873.zip
  115. - hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/beads/023318/023318.zip
  116. - hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/beads/182838/182838.zip
  117. - hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/beads/2559243.zip
  118. - hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/beads/73437.zip
  119. - hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/beads/95011855/95011855.zip
  120. - hxxp://tonytheworld[.]com/wp-content/themes/calliope/beads/1972835.zip
  121. - hxxp://tonytheworld[.]com/wp-content/themes/calliope/beads/66346120.zip
  122. - hxxp://wetechhub[.]com/wp-content/themes/calliope/beads/46724.zip
  123. - hxxps://wetechhub[.]com/wp-content/themes/calliope/beads/46724.zip
  124. - hxxps://wetechhub[.]com/wp-content/themes/calliope/beads/55248.zip
  125. - hxxps://yeknam[.]com/blog/wp-content/themes/calliope/beads/293038301/293038301.zip
  126. - hxxps://yeknam[.]com/blog/wp-content/themes/calliope/beads/302002161/302002161.zip
  127. - hxxp://yeknam[.]com/blog/wp-content/themes/calliope/beads/4384750/4384750.zip
  128. - hxxps://yeknam[.]com/blog/wp-content/themes/calliope/beads/4384750/4384750.zip
  129. - hxxps://yeknam[.]com/blog/wp-content/themes/calliope/beads/503271/503271.zip
  130. - hxxp://yeknam[.]com/blog/wp-content/themes/calliope/beads/593489/593489.zip
  131. - hxxps://yeknam[.]com/blog/wp-content/themes/calliope/beads/5972191.zip
  132.  
  133. FOLLOW-UP URLS FOR QAKBOT EXE FILES
  134.  
  135. - NOTE: These were detected by @lazyactivist192 on Twitter and posted at https://pastebin.com/hYd6S8YT (see the link for more info)
  136. - hxxp://bizzlon-realty[.]com/wp-content/themes/calliope/beads/444444.png
  137. - hxxp://pakgt[.]com/wp-content/themes/calliope/beads/444444.png
  138. - hxxp://marinerevetement[.]com/wp-content/themes/calliope/beads/444444.png
  139. - hxxp://chattosport[.]com/wp-content/themes/calliope/beads/444444.png
  140. - hxxp://a[.]coolbreeze[.]uk/213/312d/6748.png
  141.  
  142. EXAMPLES OF DOWNLOADED ZIP ARCHIVES
  143.  
  144. - 03623499d57c108ac0527658556c417422e7fc6409ff59d4f98771874fceb40e 02551515.zip
  145. - 092ec5fd8aeafd8077ad7a5901295c9c4f406a27da67b1c578ca519663e6ebe2 5401407.zip
  146. - 0c0995b99e3509cc87b494d9570cae4ee98a3ca3502276f9ffb9e50d99c2061d 9436868.zip
  147. - 1d9c629436f3ebee59996de3c58bd1c54e66a3b1aeb5780e3f338374b373198a 15424902.zip
  148. - 2577900063e21c12de8dc09e058b5af731d369fe1e18b8775f56404c5d2fba58 643205.zip
  149. - 617931242c25e39e7a0a52f1e55adfd64ab5de2d66d5743009cf529b2dfd2aac 131773.zip
  150. - 9ccf4953eaf4fbd80dcd1f92daa7953c992f9b2a07d132d87a86baffcd6e2b1d 203866920.zip
  151. - a6e0824ebe9bf14edc2ef5eecb79132b2820dccf43e95cf3e341398785fa5add 5401407.zip
  152. - b5456e11e14cfc29a4b74d32c0c7166152b4f0589687afdb306e53a6babbb391 452967.zip
  153. - de0446e49f6a21893bdf3aed093a24dbeb84e51e2fe3a180d265d3d31eb8cbbd 513719.zip
  154.  
  155. EXAMPLES OF EXTRACTED WORD DOCS
  156.  
  157. - 049a7719851ee46a58967d2057d99f4de369da661aff93d2a9c4601f083a0abe StockPurchaseAgreement_753.doc
  158. - 05bc5e13fd05ab1c3847a18358cd52038cc8f9530d4492b5bd6994cfcb72f735 StockPurchaseAgreement_963.doc
  159. - 092ec5fd8aeafd8077ad7a5901295c9c4f406a27da67b1c578ca519663e6ebe2 StockPurchaseAgreement_174.doc
  160. - 0c90259363c211aadbfd4842f1f3687230f6307bc6fcad4bd9cb0191d6a2fad7 StockPurchaseAgreement_685.doc
  161. - 2577900063e21c12de8dc09e058b5af731d369fe1e18b8775f56404c5d2fba58 StockPurchaseAgreement_963.doc
  162. - 3406d8fd836ba35c75324f926432f264119836183c1f334fdb06fa6beb6cdbdc StockPurchaseAgreement_253.doc
  163. - 4c04b859ce63b241d6bda577cf255795f9af470c5f98c8ad3e5962cc85934378 StockPurchaseAgreement_924.doc
  164. - 6158a8c61a4066c217171b8f3a3deb0548636105a8e1084a79cb24981f312ebc StockPurchaseAgreement_269.doc
  165. - 615f5e507f959cb2f460f7149206801c4da5c33c06ee894e9262d22e553b34a3 StockPurchaseAgreement_243.doc
  166. - 680d3e1c250150543375aba2a893ee3320ea3e73fae6431b5d4a1c701e64ef30 StockPurchaseAgreement_737.doc
  167. - 7f1a151d731865bca10b0f7e6b0cc861132857dc8cdd6cd741b07d541aa851a8 StockPurchaseAgreement_326.doc
  168. - b29862599aec108e4ea783f76b87dd3640724ea41f5a3c992991edb62f13edd7 StockPurchaseAgreement_110.doc
  169. - b86456bfec17ab0773c1e7c3a26ed41e66a5353a5eabe3bc48811586788bb977 StockPurchaseAgreement_956.doc
  170.  
  171. FOLLOW-UP QAKBOT EXE FILE:
  172.  
  173. - NOTE: This was detected by @lazyactivist192 on Twitter and posted at https://pastebin.com/hYd6S8YT (see the link for more info)
  174. - 59c2576cc25bbf788268d2193498cdbe10efa7a224a857443c30f328593d3fc2 444444.png
RAW Paste Data