2020-04-08: OneDrive links to zip archives for Qakbot (Qbot)

2020-04-08 - ONEDRIVE LINKS LEADING TO ZIP ARCHIVES FOR QAKBOT (QBOT):

NOTES:

- These links went live on Wednesday 2020-04-08 and were still up on Thurday 2020-04-09.
- A copy of these zip archives is available at https://www.malware-traffic-analysis.net/2020/04/08/index.html

ONEDRIVE LINKS LEADING TO ZIP ARCHIVES FOR QAKBOT:

- hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ya0fqmv8WS0rgLwo?e=hX9yH5
- hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ybGsjY9o9eQeq7lg?e=wLHr7j
- hxxps://1drv[.]ms/u/s!AlAxvhfUHk9yb3GbA4yJ-aCXJlU?e=jycpcD
- hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ycE8pD-3ZhOaL8r0?e=gasedH
- hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ycWbOgzTHHOpk0AI?e=lW2IeW
- hxxps://1drv[.]ms/u/s!AlAxvhfUHk9yc6mrtMraQERhHok?e=3V842j
- hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzfbroJgDUomzO45?e=6URjKX
- hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzbSRJKwMLkpP1Ac?e=tO1nYi
- hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzvWzIB51GLxcD_y?e=ODKx7G
- hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzzNmBL3XVM1cKL8?e=fpEgRv
- hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlz4GIYRTxCtUAivP
- hxxps://1drv[.]ms/u/s!Am7xP5Fy_1r9gkNnoFlVFvCQoeSi?e=4BZvE9
- hxxps://1drv[.]ms/u/s!Am7xP5Fy_1r9gkvw_cI8-FrBhY78?e=o5YZUt
- hxxps://1drv[.]ms/u/s!Am7xP5Fy_1r9gkzOe89tVpCE7zfS?e=GjLWMR
- hxxps://1drv[.]ms/u/s!Ah8xHTGsr9L-jGzE4Fa7rqhEc5wd

- NOTE: For any of the above URLs ending with ?e=[six characters], you can leave that part off and still get the same redirect traffic and zip archive.

FILES DOWNLOADED FROM THE ABOVE LINKS:

- Operating Agreement_1.zip
- Operating Agreement_3.zip
- Operating Agreement_6.zip
- Operating Agreement_7.zip
- Operating Agreement_8.zip
- Operating Agreement_10.zip
- Operating Agreement_11.zip
- Operating Agreement_12.zip
- Operating Agreement_15.zip
- Operating Agreement_17.zip
- Operating Agreement_19.zip
- Operating Agreement_21.zip
- Operating Agreement_29.zip
- Operating Agreement_30.zip
- Operating Agreement_35.zip

SHA256 HASHES OF THE ABOVE ZIP ARCHIVES:

- 5b0e6ade19847cae7a5a7088f562e9eb8092d75a34c13c596d6210a5103980c4
- 40c2790ea6c7e50c9bbaae99bbd83768852b09e035e98790d4bfcfc3a49d0993
- 95489da47c67fc6d04e2cdd7b653d7b941f6be1f3ad9a83b8449ffd519df2537
- adbc53a05df0a8976dcd981854a1e4fd713a4a4b4e6c1ef5d01f63be82e2030d
- d6b04bcdcc33f6263ca54aa8e3498c8dfbdfea0d6f492df507f546849a8967b5
- 482cc0fa4c526cd4631ff170b36b5d42590ac512fdf5d54ed38aa31750f9a795
- 79067452207868d62d058f91ca91827011dd192a3cc520cbcf9ee2f92bfc7bec
- cb4f812046551e7e0535f0241425a7585473015b13dfb0efd89944e0a96666e3
- 05618ce4bad0b5828d8859d4b0f5b26e938f54676d7737c00485fbe0c4fba825
- ff6bd4cbf9582c8948b2d03d07172519339641878b01cf04b1a5ce5695828204
- 917395cedc803ce18b37f78fe6b1c1cd71f10ebc511b9ffd0cb8c99eca66cafd
- a64c23f9a20d2ac59d47f32694f219bd3f57b2a6814993a89e0582505e45c448
- 6bb790f650df7b31220e1522d8ab2f939ae40c647b47328678567b06415d09c4
- dcdf67e8404b3ce91acf0789a4abf8c312e8eaba69739d2d7f08ebc532c9d814
- 6cb9db70a3274cd92a3c1a22a2149a73e844f7378c5a6256d972079d0a477c29

CORRELATED INFO:

- SHA256 hash: 5b0e6ade19847cae7a5a7088f562e9eb8092d75a34c13c596d6210a5103980c4
- File size: 170,781 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ya0fqmv8WS0rgLwo?e=hX9yH5
- File name: Operating Agreement_1.zip

- SHA256 hash: 40c2790ea6c7e50c9bbaae99bbd83768852b09e035e98790d4bfcfc3a49d0993
- File size: 170,781 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ybGsjY9o9eQeq7lg?e=wLHr7j
- File name: Operating Agreement_3.zip

- SHA256 hash: 95489da47c67fc6d04e2cdd7b653d7b941f6be1f3ad9a83b8449ffd519df2537
- File size: 170,781 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!AlAxvhfUHk9yb3GbA4yJ-aCXJlU?e=jycpcD
- File name: Operating Agreement_6.zip

- SHA256 hash: adbc53a05df0a8976dcd981854a1e4fd713a4a4b4e6c1ef5d01f63be82e2030d
- File size: 170,781 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ycE8pD-3ZhOaL8r0?e=gasedH
- File name: Operating Agreement_7.zip

- SHA256 hash: d6b04bcdcc33f6263ca54aa8e3498c8dfbdfea0d6f492df507f546849a8967b5
- File size: 170,781 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!AlAxvhfUHk9ycWbOgzTHHOpk0AI?e=lW2IeW
- File name: Operating Agreement_8.zip

- SHA256 hash: 482cc0fa4c526cd4631ff170b36b5d42590ac512fdf5d54ed38aa31750f9a795
- File size: 170,783 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!AlAxvhfUHk9yc6mrtMraQERhHok?e=3V842j
- File name: Operating Agreement_10.zip

- SHA256 hash: 79067452207868d62d058f91ca91827011dd192a3cc520cbcf9ee2f92bfc7bec
- File size: 170,783 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzfbroJgDUomzO45?e=6URjKX
- File name: Operating Agreement_11.zip

- SHA256 hash: cb4f812046551e7e0535f0241425a7585473015b13dfb0efd89944e0a96666e3
- File size: 170,783 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzbSRJKwMLkpP1Ac?e=tO1nYi
- File name: Operating Agreement_12.zip

- SHA256 hash: 05618ce4bad0b5828d8859d4b0f5b26e938f54676d7737c00485fbe0c4fba825
- File size: 170,783 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzvWzIB51GLxcD_y?e=ODKx7G
- File name: Operating Agreement_15.zip

- SHA256 hash: ff6bd4cbf9582c8948b2d03d07172519339641878b01cf04b1a5ce5695828204
- File size: 170,783 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlzzNmBL3XVM1cKL8?e=fpEgRv
- File name: Operating Agreement_17.zip

- SHA256 hash: 917395cedc803ce18b37f78fe6b1c1cd71f10ebc511b9ffd0cb8c99eca66cafd
- File size: 170,783 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!An0EeTXBN8JIlz4GIYRTxCtUAivP
- File name: Operating Agreement_19.zip

- SHA256 hash: a64c23f9a20d2ac59d47f32694f219bd3f57b2a6814993a89e0582505e45c448
- File size: 170,783 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!Am7xP5Fy_1r9gkNnoFlVFvCQoeSi?e=4BZvE9
- File name: Operating Agreement_21.zip

- SHA256 hash: 6bb790f650df7b31220e1522d8ab2f939ae40c647b47328678567b06415d09c4
- File size: 170,783 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!Am7xP5Fy_1r9gkvw_cI8-FrBhY78?e=o5YZUt
- File name: Operating Agreement_29.zip

- SHA256 hash: dcdf67e8404b3ce91acf0789a4abf8c312e8eaba69739d2d7f08ebc532c9d814
- File size: 170,783 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!Am7xP5Fy_1r9gkzOe89tVpCE7zfS?e=GjLWMR
- File name: Operating Agreement_30.zip

- SHA256 hash: 6cb9db70a3274cd92a3c1a22a2149a73e844f7378c5a6256d972079d0a477c29
- File size: 170,783 bytes
- OneDrive link: hxxps://1drv[.]ms/u/s!Ah8xHTGsr9L-jGzE4Fa7rqhEc5wd
- File name: Operating Agreement_35.zip

SHA256 HASHES OF EXTRACTED WORD DOCS:

- 8719ead4bd37ad01fe48dd72824b7e5b396a44cc4308451f7d694b6f0dcf78b5 - Operating Agreement_1.doc
- 7d862b2fc9388a96f9954fa81ac0861906506ec7093d173b9f6f82aff0203b11 - Operating Agreement_3.doc
- d3b6acb0b498285f40fe7f7a6bebf4e34bcb0ef932f6ad1df2f33f176e79a5a7 - Operating Agreement_6.doc
- a4bfa1a6e4a37cec0de855a4e8632c6dc7cb468d6b247bc8e079df87d7483df9 - Operating Agreement_7.doc
- 301ed4f994813ed3b6be7f12e30fb5bc7501b58da548fc3c9f454d0064b86d95 - Operating Agreement_8.doc
- 54c16d1aa2454c5b25faf89f7ac9ad02e24d9ba6ba70457af2364daffdde69bc - Operating Agreement_10.doc
- fc9a1081464d1f5f3ace27df6f8c1a1a0edf979934d352eb4e022b575428e606 - Operating Agreement_11.doc
- dbcebe6af9df0c28580ba758becc25999a1f7b72fafc29020c08e7426dfe4f58 - Operating Agreement_12.doc
- 9f7ac05d0aeefb36ccaec16066ab5bb3a1883621a1ca5df8b4d0d40fb355da9d - Operating Agreement_15.doc
- e70b7b5eae4f984dccd475187436cb2f758c944a604353458acef7562251bdc2 - Operating Agreement_17.doc
- ab3d3c66af48ea00b64739c3e997ece4cc67ea0a44c6a6f295bc447df3cb6c00 - Operating Agreement_19.doc
- e51ad541799caa88782f29ff1cf4eac6ff73eff2922b0bb2a5eec8393131be1c - Operating Agreement_21.doc
- 5db009bf7b80ccb2652bfbc0f4355d2a172173c193f7ec95eb587a89b65c3b61 - Operating Agreement_29.doc
- 452c343047ce2fa0c36fd33695a249f96d0db4b284356816ee271619b1031398 - Operating Agreement_30.doc
- ee7ec3369d80db6249e8b29c052709cfca1bb1fb01308d61dfc903ca410c02b6 - Operating Agreement_35.doc