Qakbot_06_11_2020

Qakbot spun up spx138 around 13:47.  Pastebin removed my original paste around 14:33.  Thanks pastebin.

There was interestingly a DLL available for download as well.

VBS Name: TALQ_869273889779_10062020.vbs

URLs:
http://sometechsense.com/wp-includes/js/tinymce/plugins/wptextpattern/tbpfdfelf/8888888.jpg
http://digitalschoolfaridabad.in/courses/images/parallax/mjogqxakfxg/8888888.jpg
http://ameliasmoments.com/wp-includes/js/thickbox/wifgyfro/8888888.jpg
http://uniquehindunames.com/wp-content/uploads/cnesco/8888888.jpg
http://amandadecardy.com/NSUEdD/wp-includes/js/tinymce/plugins/directionality/pdvav/8888888.jpg

IPs:
70.168.130.172:443
41.129.128.231:443
190.147.186.58:443
98.32.60.217:443
94.10.81.239:443
68.225.56.31:443
108.54.205.207:443
201.215.29.153:443
72.240.245.253:443
69.200.233.121:443
76.185.136.58:443
98.116.62.242:443
98.240.24.57:443
96.27.47.70:2222
78.101.138.135:443
96.41.93.96:443
71.56.53.127:443
68.200.23.189:443
76.187.8.160:443
146.200.250.17:2222
89.32.221.178:443
184.89.71.68:443
24.229.150.54:995
72.214.55.147:995
73.209.113.58:443
47.138.200.85:443
85.154.206.152:443
216.137.140.236:2222
24.42.14.241:995
69.92.54.95:995
66.222.88.126:995
207.255.161.8:32102
85.204.189.105:443
50.29.166.232:995
108.30.125.94:443
92.99.204.211:995
184.98.104.7:995
5.13.75.246:443
70.174.3.241:443
72.204.242.138:50003
137.99.222.152:443
50.244.112.10:443
24.43.22.220:995
72.204.242.138:80
72.204.242.138:443
96.56.237.174:990
24.202.42.48:2222
69.11.247.242:443
93.118.209.198:443
5.13.102.132:995
86.153.98.75:2222
75.183.135.48:443
5.107.229.6:2222
98.215.226.61:443
65.30.213.13:6882
190.220.8.10:443
68.4.137.211:443
66.57.216.53:993
96.23.62.35:2222
193.248.44.2:2222
47.203.42.163:443
96.56.237.174:32103
100.40.48.96:443
67.8.103.21:443
47.222.40.131:443
190.158.225.3:443
96.232.203.15:443
72.255.200.69:2222
24.231.54.185:2222
71.182.142.63:443
203.122.7.82:443
176.223.43.145:2222
2.45.53.40:2222
140.82.21.191:443
2.190.200.253:443
75.183.171.155:3389
66.26.160.37:443
134.0.196.46:995
65.131.83.170:995
72.204.242.138:32100
77.159.149.74:443
72.204.242.138:32102
200.113.201.83:993
72.204.242.138:6881
72.16.212.108:465
76.170.77.99:443
47.153.115.154:995
67.250.184.157:443
47.146.169.85:443
96.37.137.42:443
67.209.195.198:3389
82.210.157.185:443
80.195.103.146:2222
74.56.167.31:443
72.204.242.138:995
216.201.162.158:995
78.102.138.103:995
189.236.218.181:443
193.23.5.134:443
73.226.220.56:443
173.49.122.160:995
72.204.242.138:2078
47.41.3.40:443
49.191.4.245:443
73.214.248.17:995
207.255.161.8:443
100.38.123.22:443
89.247.216.17:443
79.113.215.51:443
41.34.37.106:995
70.183.127.6:995
50.104.68.223:443
86.127.24.61:21
69.28.222.54:443
24.201.79.208:2078
72.204.242.138:443
172.242.156.50:995
74.193.197.246:443
184.96.155.4:993
68.174.15.223:443
98.115.138.61:443
66.208.105.6:443
75.87.161.32:995
207.162.184.228:443
98.118.156.172:443
76.86.57.179:2222
97.93.211.17:443
72.204.242.138:50001
173.245.152.231:443
72.36.59.46:2222
65.116.179.83:443
24.228.7.174:443
173.3.132.17:995
24.110.96.149:443
69.246.151.5:995
187.163.101.137:995
207.255.161.8:32103
68.49.120.179:443
200.75.136.78:443
206.51.202.106:50003
47.153.115.154:443
24.152.219.253:995
207.255.161.8:2222
108.183.3.41:443
47.152.210.233:443
98.219.77.197:443
71.172.110.236:443
67.6.51.96:443
82.127.193.151:2222
173.175.29.210:443

https://app.any.run/tasks/96c6abb2-733d-4065-9f31-14ca93e691b1

Mirror: https://ghostbin.co/paste/t2aeh