malware_traffic

2020-04-08: OneDrive links to zip archives for Qakbot (Qbot)

Apr 9th, 2020
1,775
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2020-04-08 - ONEDRIVE LINKS LEADING TO ZIP ARCHIVES FOR QAKBOT (QBOT):
  2.  
  3. NOTES:
  4.  
  5. - These links went live on Wednesday 2020-04-08 and were still up on Thurday 2020-04-09.
  6. - A copy of these zip archives is available at https://www.malware-traffic-analysis.net/2020/04/08/index.html
  7.  
  8. ONEDRIVE LINKS LEADING TO ZIP ARCHIVES FOR QAKBOT:
  9.  
  10. - hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ya0fqmv8WS0rgLwo?e=hX9yH5
  11. - hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ybGsjY9o9eQeq7lg?e=wLHr7j
  12. - hxxps://1drv[.]ms/u/s!AlAxvhfUHk9yb3GbA4yJ-aCXJlU?e=jycpcD
  13. - hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ycE8pD-3ZhOaL8r0?e=gasedH
  14. - hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ycWbOgzTHHOpk0AI?e=lW2IeW
  15. - hxxps://1drv[.]ms/u/s!AlAxvhfUHk9yc6mrtMraQERhHok?e=3V842j
  16. - hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzfbroJgDUomzO45?e=6URjKX
  17. - hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzbSRJKwMLkpP1Ac?e=tO1nYi
  18. - hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzvWzIB51GLxcD_y?e=ODKx7G
  19. - hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzzNmBL3XVM1cKL8?e=fpEgRv
  20. - hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlz4GIYRTxCtUAivP
  21. - hxxps://1drv[.]ms/u/s!Am7xP5Fy_1r9gkNnoFlVFvCQoeSi?e=4BZvE9
  22. - hxxps://1drv[.]ms/u/s!Am7xP5Fy_1r9gkvw_cI8-FrBhY78?e=o5YZUt
  23. - hxxps://1drv[.]ms/u/s!Am7xP5Fy_1r9gkzOe89tVpCE7zfS?e=GjLWMR
  24. - hxxps://1drv[.]ms/u/s!Ah8xHTGsr9L-jGzE4Fa7rqhEc5wd
  25.  
  26. - NOTE: For any of the above URLs ending with ?e=[six characters], you can leave that part off and still get the same redirect traffic and zip archive.
  27.  
  28. FILES DOWNLOADED FROM THE ABOVE LINKS:
  29.  
  30. - Operating Agreement_1.zip
  31. - Operating Agreement_3.zip
  32. - Operating Agreement_6.zip
  33. - Operating Agreement_7.zip
  34. - Operating Agreement_8.zip
  35. - Operating Agreement_10.zip
  36. - Operating Agreement_11.zip
  37. - Operating Agreement_12.zip
  38. - Operating Agreement_15.zip
  39. - Operating Agreement_17.zip
  40. - Operating Agreement_19.zip
  41. - Operating Agreement_21.zip
  42. - Operating Agreement_29.zip
  43. - Operating Agreement_30.zip
  44. - Operating Agreement_35.zip
  45.  
  46. SHA256 HASHES OF THE ABOVE ZIP ARCHIVES:
  47.  
  48. - 5b0e6ade19847cae7a5a7088f562e9eb8092d75a34c13c596d6210a5103980c4
  49. - 40c2790ea6c7e50c9bbaae99bbd83768852b09e035e98790d4bfcfc3a49d0993
  50. - 95489da47c67fc6d04e2cdd7b653d7b941f6be1f3ad9a83b8449ffd519df2537
  51. - adbc53a05df0a8976dcd981854a1e4fd713a4a4b4e6c1ef5d01f63be82e2030d
  52. - d6b04bcdcc33f6263ca54aa8e3498c8dfbdfea0d6f492df507f546849a8967b5
  53. - 482cc0fa4c526cd4631ff170b36b5d42590ac512fdf5d54ed38aa31750f9a795
  54. - 79067452207868d62d058f91ca91827011dd192a3cc520cbcf9ee2f92bfc7bec
  55. - cb4f812046551e7e0535f0241425a7585473015b13dfb0efd89944e0a96666e3
  56. - 05618ce4bad0b5828d8859d4b0f5b26e938f54676d7737c00485fbe0c4fba825
  57. - ff6bd4cbf9582c8948b2d03d07172519339641878b01cf04b1a5ce5695828204
  58. - 917395cedc803ce18b37f78fe6b1c1cd71f10ebc511b9ffd0cb8c99eca66cafd
  59. - a64c23f9a20d2ac59d47f32694f219bd3f57b2a6814993a89e0582505e45c448
  60. - 6bb790f650df7b31220e1522d8ab2f939ae40c647b47328678567b06415d09c4
  61. - dcdf67e8404b3ce91acf0789a4abf8c312e8eaba69739d2d7f08ebc532c9d814
  62. - 6cb9db70a3274cd92a3c1a22a2149a73e844f7378c5a6256d972079d0a477c29
  63.  
  64. CORRELATED INFO:
  65.  
  66. - SHA256 hash: 5b0e6ade19847cae7a5a7088f562e9eb8092d75a34c13c596d6210a5103980c4
  67. - File size: 170,781 bytes
  68. - OneDrive link: hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ya0fqmv8WS0rgLwo?e=hX9yH5
  69. - File name: Operating Agreement_1.zip
  70.  
  71. - SHA256 hash: 40c2790ea6c7e50c9bbaae99bbd83768852b09e035e98790d4bfcfc3a49d0993
  72. - File size: 170,781 bytes
  73. - OneDrive link: hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ybGsjY9o9eQeq7lg?e=wLHr7j
  74. - File name: Operating Agreement_3.zip
  75.  
  76. - SHA256 hash: 95489da47c67fc6d04e2cdd7b653d7b941f6be1f3ad9a83b8449ffd519df2537
  77. - File size: 170,781 bytes
  78. - OneDrive link: hxxps://1drv[.]ms/u/s!AlAxvhfUHk9yb3GbA4yJ-aCXJlU?e=jycpcD
  79. - File name: Operating Agreement_6.zip
  80.  
  81. - SHA256 hash: adbc53a05df0a8976dcd981854a1e4fd713a4a4b4e6c1ef5d01f63be82e2030d
  82. - File size: 170,781 bytes
  83. - OneDrive link: hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ycE8pD-3ZhOaL8r0?e=gasedH
  84. - File name: Operating Agreement_7.zip
  85.  
  86. - SHA256 hash: d6b04bcdcc33f6263ca54aa8e3498c8dfbdfea0d6f492df507f546849a8967b5
  87. - File size: 170,781 bytes
  88. - OneDrive link: hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ycWbOgzTHHOpk0AI?e=lW2IeW
  89. - File name: Operating Agreement_8.zip
  90.  
  91. - SHA256 hash: 482cc0fa4c526cd4631ff170b36b5d42590ac512fdf5d54ed38aa31750f9a795
  92. - File size: 170,783 bytes
  93. - OneDrive link: hxxps://1drv[.]ms/u/s!AlAxvhfUHk9yc6mrtMraQERhHok?e=3V842j
  94. - File name: Operating Agreement_10.zip
  95.  
  96. - SHA256 hash: 79067452207868d62d058f91ca91827011dd192a3cc520cbcf9ee2f92bfc7bec
  97. - File size: 170,783 bytes
  98. - OneDrive link: hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzfbroJgDUomzO45?e=6URjKX
  99. - File name: Operating Agreement_11.zip
  100.  
  101. - SHA256 hash: cb4f812046551e7e0535f0241425a7585473015b13dfb0efd89944e0a96666e3
  102. - File size: 170,783 bytes
  103. - OneDrive link: hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzbSRJKwMLkpP1Ac?e=tO1nYi
  104. - File name: Operating Agreement_12.zip
  105.  
  106. - SHA256 hash: 05618ce4bad0b5828d8859d4b0f5b26e938f54676d7737c00485fbe0c4fba825
  107. - File size: 170,783 bytes
  108. - OneDrive link: hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzvWzIB51GLxcD_y?e=ODKx7G
  109. - File name: Operating Agreement_15.zip
  110.  
  111. - SHA256 hash: ff6bd4cbf9582c8948b2d03d07172519339641878b01cf04b1a5ce5695828204
  112. - File size: 170,783 bytes
  113. - OneDrive link: hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzzNmBL3XVM1cKL8?e=fpEgRv
  114. - File name: Operating Agreement_17.zip
  115.  
  116. - SHA256 hash: 917395cedc803ce18b37f78fe6b1c1cd71f10ebc511b9ffd0cb8c99eca66cafd
  117. - File size: 170,783 bytes
  118. - OneDrive link: hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlz4GIYRTxCtUAivP
  119. - File name: Operating Agreement_19.zip
  120.  
  121. - SHA256 hash: a64c23f9a20d2ac59d47f32694f219bd3f57b2a6814993a89e0582505e45c448
  122. - File size: 170,783 bytes
  123. - OneDrive link: hxxps://1drv[.]ms/u/s!Am7xP5Fy_1r9gkNnoFlVFvCQoeSi?e=4BZvE9
  124. - File name: Operating Agreement_21.zip
  125.  
  126. - SHA256 hash: 6bb790f650df7b31220e1522d8ab2f939ae40c647b47328678567b06415d09c4
  127. - File size: 170,783 bytes
  128. - OneDrive link: hxxps://1drv[.]ms/u/s!Am7xP5Fy_1r9gkvw_cI8-FrBhY78?e=o5YZUt
  129. - File name: Operating Agreement_29.zip
  130.  
  131. - SHA256 hash: dcdf67e8404b3ce91acf0789a4abf8c312e8eaba69739d2d7f08ebc532c9d814
  132. - File size: 170,783 bytes
  133. - OneDrive link: hxxps://1drv[.]ms/u/s!Am7xP5Fy_1r9gkzOe89tVpCE7zfS?e=GjLWMR
  134. - File name: Operating Agreement_30.zip
  135.  
  136. - SHA256 hash: 6cb9db70a3274cd92a3c1a22a2149a73e844f7378c5a6256d972079d0a477c29
  137. - File size: 170,783 bytes
  138. - OneDrive link: hxxps://1drv[.]ms/u/s!Ah8xHTGsr9L-jGzE4Fa7rqhEc5wd
  139. - File name: Operating Agreement_35.zip
  140.  
  141. SHA256 HASHES OF EXTRACTED WORD DOCS:
  142.  
  143. - 8719ead4bd37ad01fe48dd72824b7e5b396a44cc4308451f7d694b6f0dcf78b5 - Operating Agreement_1.doc
  144. - 7d862b2fc9388a96f9954fa81ac0861906506ec7093d173b9f6f82aff0203b11 - Operating Agreement_3.doc
  145. - d3b6acb0b498285f40fe7f7a6bebf4e34bcb0ef932f6ad1df2f33f176e79a5a7 - Operating Agreement_6.doc
  146. - a4bfa1a6e4a37cec0de855a4e8632c6dc7cb468d6b247bc8e079df87d7483df9 - Operating Agreement_7.doc
  147. - 301ed4f994813ed3b6be7f12e30fb5bc7501b58da548fc3c9f454d0064b86d95 - Operating Agreement_8.doc
  148. - 54c16d1aa2454c5b25faf89f7ac9ad02e24d9ba6ba70457af2364daffdde69bc - Operating Agreement_10.doc
  149. - fc9a1081464d1f5f3ace27df6f8c1a1a0edf979934d352eb4e022b575428e606 - Operating Agreement_11.doc
  150. - dbcebe6af9df0c28580ba758becc25999a1f7b72fafc29020c08e7426dfe4f58 - Operating Agreement_12.doc
  151. - 9f7ac05d0aeefb36ccaec16066ab5bb3a1883621a1ca5df8b4d0d40fb355da9d - Operating Agreement_15.doc
  152. - e70b7b5eae4f984dccd475187436cb2f758c944a604353458acef7562251bdc2 - Operating Agreement_17.doc
  153. - ab3d3c66af48ea00b64739c3e997ece4cc67ea0a44c6a6f295bc447df3cb6c00 - Operating Agreement_19.doc
  154. - e51ad541799caa88782f29ff1cf4eac6ff73eff2922b0bb2a5eec8393131be1c - Operating Agreement_21.doc
  155. - 5db009bf7b80ccb2652bfbc0f4355d2a172173c193f7ec95eb587a89b65c3b61 - Operating Agreement_29.doc
  156. - 452c343047ce2fa0c36fd33695a249f96d0db4b284356816ee271619b1031398 - Operating Agreement_30.doc
  157. - ee7ec3369d80db6249e8b29c052709cfca1bb1fb01308d61dfc903ca410c02b6 - Operating Agreement_35.doc
RAW Paste Data