2020-04-23 - URLs/hashes for Qakbot (Qbot) spx103 files

2020-04-23 (THURSDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX103, THE "/docs_[3 characters]/" WAVE

URLS FOR THE INITIAL ZIP ARCHIVES:

- hxxp://beta[.]vaspotrcko[.]rs/docs_01g/21744971/Judgement_04222020_21744971.zip
- hxxp://beta[.]vaspotrcko[.]rs/docs_01g/Judgement_04222020_8695470.zip
- hxxp://bgszone[.]ga/docs_e48/6292603/Judgement_04222020_6292603.zip
- hxxp://bgszone[.]ga/docs_e48/Judgement_04222020_09992.zip
- hxxp://bgszone[.]ga/docs_e48/Judgement_04222020_3842913.zip
- hxxp://biacayipteknoloji[.]com/docs_h1x/Judgement_04222020_47141554.zip
- hxxp://biacayipteknoloji[.]com/docs_h1x/Judgement_04222020_945063087.zip
- hxxp://www[.]blueleed[.]com/wp-content/plugins/advanced-ads-genesis/docs_try/2391241/Judgement_04222020_2391241.zip
- hxxp://dubook[.]co[.]in/docs_5et/864422649/Judgement_04222020_864422649.zip
- hxxp://far-flower[.]mindsellers[.]ru/wp-content/plugins/apikey/docs_d64/054309/Judgement_04222020_054309.zip
- hxxps://www[.]foxfennecs[.]com/wp-content/themes/calliope/docs_v72/084594017/Judgement_04222020_084594017.zip
- hxxp://hasifria[.]net/wp-content/uploads/2020/04/docs_jsv/Judgement_04222020_65639.zip
- hxxp://hlb[.]ae/docs_q22/Judgement_04222020_69120.zip
- hxxps://jaincakes[.]xyz/docs_1o2/108393672/Judgement_04222020_108393672.zip
- hxxps://jaincakes[.]xyz/docs_1o2/818263/Judgement_04222020_818263.zip
- hxxps://jaincakes[.]xyz/docs_1o2/949025839/Judgement_04222020_949025839.zip
- hxxp://ixlarge[.]net/docs_to2/Judgement_04222020_490035134.zip
- hxxp://kastom[.]pw/docs_jvq/80188/Judgement_04222020_80188.zip
- hxxp://ngoibitumsinhthai[.]com[.]vn/docs_asx/Judgement_04222020_819411.zip
- hxxp://papaw[.]doudou1998[.]com/docs_y59/587518/Judgement_04222020_587518.zip
- hxxp://papaw[.]doudou1998[.]com/docs_y59/Judgement_04222020_883379667.zip
- hxxp://pinangcitygroup[.]asia/wp-content/uploads/2020/04/docs_cgj/704043/Judgement_04222020_704043.zip
- hxxp://pinangcitygroup[.]asia/wp-content/uploads/2020/04/docs_cgj/Judgement_04222020_211032903.zip
- hxxp://pinangcitygroup[.]asia/wp-content/uploads/2020/04/docs_cgj/Judgement_04222020_56507748.zip
- hxxp://playvideo[.]site/docs_8kj/81588387/Judgement_04222020_81588387.zip
- hxxp://playvideo[.]site/docs_8kj/Judgement_04222020_0736741.zip
- hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/docs_tpm/250122449/Judgement_04222020_250122449.zip
- hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/docs_tpm/Judgement_04222020_5460712.zip
- hxxps://uvisionpk[.]com/wp/wp-content/themes/calliope/docs_4ru/6004556/Judgement_04222020_6004556.zip
- hxxps://uvisionpk[.]com/wp/wp-content/themes/calliope/docs_4ru/Judgement_04222020_70525.zip

URLS FOR THE QAKBOT EXE FILES:

- NOTE: These were first noted by @lazyactivist192 on Twitter and posted at https://pastebin.com/7bYzetJF (see the link for more info)
- hxxp://atn24live[.]com/spool/8888.png?uid=[base64 string]
- hxxp://bg142[.]caliphs[.]my/spool/8888.png?uid=[base64 string]
- hxxp://afsholdings[.]com[.]my/spool/8888.png?uid=[base64 string]
- hxxp://alphapioneer[.]com/spool/8888.png?uid=[base64 string]
- hxxp://kbzsa[.]cn/wp-content/plugins/apikey/spool/8888.png?uid=[base64 string]

NOTE:

- Malware samples below are available at: https://www.malware-traffic-analysis.net/2020/04/23/index.html

EXAMPLES OF DOWNLOADED ZIP ARCHIVES:

- 3ce476d7ed1f44b6e6ae7181995b03947b607f13795b0c29f1558106ee5c4de3  Judgement_04222020_211032903.zip
- 9c73ad1cb1039e993d9c76758e5d83fd810a37be0149544b368239e7425dd0a0  Judgement_04222020_2391241.zip
- 54e25795ac1a1c4633e1dec3e9b3cfb6051252bac4be4d86507ad36bc63bc9cd  Judgement_04222020_3842913.zip
- ad18b077b6f0d19d6e9d693a21c27cef7a9974ede5ac4045b7ec84f6d56af2e4  Judgement_04222020_6004556.zip
- ea0f3e681d4a1313e766a3c452e269e4119050a2cf8678132c568676b7a4f88e  Judgement_04222020_6292603.zip
- 827cda6369854771aaed444aed5780da8984d9d294f2fe7d6433ea7e5b2eb7fa  Judgement_04222020_704043.zip
- 75e0c0f122bd98f011223e87175f9729e3edd4fd66cacd3656feb233cced8852  Judgement_04222020_80188.zip
- ed2687a6c20abf2e952d9ff522344a39fa25d7d5b3cad84576f05b15c4aeeee0  Judgement_04222020_8695470.zip

EXAMPLES OF EXTRACTED VBS FILES:

- a9112a8b6cf06710e7d4b60408865787f1d6e31c320e7b497618a0f88e0b92e3  Judgement_04222020_1546.vbs
- 4b6417d713582630160b35658a921cebc37c1d44907d54e99ddd95e1e7d66d2f  Judgement_04222020_1741.vbs
- fabd563e131eac4798f612d08fb707a3839632eb763115e5f7ca4d1e24a02dec  Judgement_04222020_2166.vbs
- 7822b381dbc01d9625b2a3175fe16334c24e4ca22b337238def6206e08677d39  Judgement_04222020_250.vbs
- 080b0bbff0628df551338a727121424293bcd9dda2864297fe520a283afc4d27  Judgement_04222020_290.vbs
- 0e8c9cb759b247bd9dacddc7190d4b95b99610d077f73b56e62c97fe66b94d94  Judgement_04222020_4074.vbs
- dea0a225cbc95b301ab070815c789fb84ee9611f89d55c8e28a1f8c8e4a5c590  Judgement_04222020_40954.vbs
- ffdbfad447d2363a5827b2df5741845bdfb464b809ac8dc37bc63101f8e5ef6f  Judgement_04222020_4853.vbs

EXAMPLES OF QAKBOT EXE FILES (ALL 1,950,208 BYTES):

- 78d4d6748dd89f7df5677df37d7aabfa459a080ec777edad87e0d9beab2e2c98  C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- 6a03748cc1b3aa9d28e1a0968b1f64c7fe63e527e9f047ca4a51855434897e36  C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- fcd62eaf45bac0417f7b27791f21c6867e4b77d95a33e52bda0d9f1f846264fa  C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- 16b82fdf31a59649f5340cabc8a2946b91c7e81c90a1a2e2026f66653043b91d  C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- 64031f76d624dbdc8a21deff4a4caccbec13138b1232fd77eddaf1e47c5a1302  C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- cb108c9977f7cc82b93aed9fbddefdbe356649bd4bfb4ce1f66c0ea8f8ace9d9  C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- 4b1889589fb591a56baf1c8f7751e13c856e9219db046acbdcb9b48211267d02  C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- 10e8c1693d5ac22b2d7c33235d080d027456e47535053a31b05e698bc07296f1  C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe