malware_traffic

2020-04-23 - URLs/hashes for Qakbot (Qbot) spx103 files

Apr 23rd, 2020
1,619
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2020-04-23 (THURSDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX103, THE "/docs_[3 characters]/" WAVE
  2.  
  3. URLS FOR THE INITIAL ZIP ARCHIVES:
  4.  
  5. - hxxp://beta[.]vaspotrcko[.]rs/docs_01g/21744971/Judgement_04222020_21744971.zip
  6. - hxxp://beta[.]vaspotrcko[.]rs/docs_01g/Judgement_04222020_8695470.zip
  7. - hxxp://bgszone[.]ga/docs_e48/6292603/Judgement_04222020_6292603.zip
  8. - hxxp://bgszone[.]ga/docs_e48/Judgement_04222020_09992.zip
  9. - hxxp://bgszone[.]ga/docs_e48/Judgement_04222020_3842913.zip
  10. - hxxp://biacayipteknoloji[.]com/docs_h1x/Judgement_04222020_47141554.zip
  11. - hxxp://biacayipteknoloji[.]com/docs_h1x/Judgement_04222020_945063087.zip
  12. - hxxp://www[.]blueleed[.]com/wp-content/plugins/advanced-ads-genesis/docs_try/2391241/Judgement_04222020_2391241.zip
  13. - hxxp://dubook[.]co[.]in/docs_5et/864422649/Judgement_04222020_864422649.zip
  14. - hxxp://far-flower[.]mindsellers[.]ru/wp-content/plugins/apikey/docs_d64/054309/Judgement_04222020_054309.zip
  15. - hxxps://www[.]foxfennecs[.]com/wp-content/themes/calliope/docs_v72/084594017/Judgement_04222020_084594017.zip
  16. - hxxp://hasifria[.]net/wp-content/uploads/2020/04/docs_jsv/Judgement_04222020_65639.zip
  17. - hxxp://hlb[.]ae/docs_q22/Judgement_04222020_69120.zip
  18. - hxxps://jaincakes[.]xyz/docs_1o2/108393672/Judgement_04222020_108393672.zip
  19. - hxxps://jaincakes[.]xyz/docs_1o2/818263/Judgement_04222020_818263.zip
  20. - hxxps://jaincakes[.]xyz/docs_1o2/949025839/Judgement_04222020_949025839.zip
  21. - hxxp://ixlarge[.]net/docs_to2/Judgement_04222020_490035134.zip
  22. - hxxp://kastom[.]pw/docs_jvq/80188/Judgement_04222020_80188.zip
  23. - hxxp://ngoibitumsinhthai[.]com[.]vn/docs_asx/Judgement_04222020_819411.zip
  24. - hxxp://papaw[.]doudou1998[.]com/docs_y59/587518/Judgement_04222020_587518.zip
  25. - hxxp://papaw[.]doudou1998[.]com/docs_y59/Judgement_04222020_883379667.zip
  26. - hxxp://pinangcitygroup[.]asia/wp-content/uploads/2020/04/docs_cgj/704043/Judgement_04222020_704043.zip
  27. - hxxp://pinangcitygroup[.]asia/wp-content/uploads/2020/04/docs_cgj/Judgement_04222020_211032903.zip
  28. - hxxp://pinangcitygroup[.]asia/wp-content/uploads/2020/04/docs_cgj/Judgement_04222020_56507748.zip
  29. - hxxp://playvideo[.]site/docs_8kj/81588387/Judgement_04222020_81588387.zip
  30. - hxxp://playvideo[.]site/docs_8kj/Judgement_04222020_0736741.zip
  31. - hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/docs_tpm/250122449/Judgement_04222020_250122449.zip
  32. - hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/docs_tpm/Judgement_04222020_5460712.zip
  33. - hxxps://uvisionpk[.]com/wp/wp-content/themes/calliope/docs_4ru/6004556/Judgement_04222020_6004556.zip
  34. - hxxps://uvisionpk[.]com/wp/wp-content/themes/calliope/docs_4ru/Judgement_04222020_70525.zip
  35.  
  36. URLS FOR THE QAKBOT EXE FILES:
  37.  
  38. - NOTE: These were first noted by @lazyactivist192 on Twitter and posted at https://pastebin.com/7bYzetJF (see the link for more info)
  39. - hxxp://atn24live[.]com/spool/8888.png?uid=[base64 string]
  40. - hxxp://bg142[.]caliphs[.]my/spool/8888.png?uid=[base64 string]
  41. - hxxp://afsholdings[.]com[.]my/spool/8888.png?uid=[base64 string]
  42. - hxxp://alphapioneer[.]com/spool/8888.png?uid=[base64 string]
  43. - hxxp://kbzsa[.]cn/wp-content/plugins/apikey/spool/8888.png?uid=[base64 string]
  44.  
  45. NOTE:
  46.  
  47. - Malware samples below are available at: https://www.malware-traffic-analysis.net/2020/04/23/index.html
  48.  
  49. EXAMPLES OF DOWNLOADED ZIP ARCHIVES:
  50.  
  51. - 3ce476d7ed1f44b6e6ae7181995b03947b607f13795b0c29f1558106ee5c4de3 Judgement_04222020_211032903.zip
  52. - 9c73ad1cb1039e993d9c76758e5d83fd810a37be0149544b368239e7425dd0a0 Judgement_04222020_2391241.zip
  53. - 54e25795ac1a1c4633e1dec3e9b3cfb6051252bac4be4d86507ad36bc63bc9cd Judgement_04222020_3842913.zip
  54. - ad18b077b6f0d19d6e9d693a21c27cef7a9974ede5ac4045b7ec84f6d56af2e4 Judgement_04222020_6004556.zip
  55. - ea0f3e681d4a1313e766a3c452e269e4119050a2cf8678132c568676b7a4f88e Judgement_04222020_6292603.zip
  56. - 827cda6369854771aaed444aed5780da8984d9d294f2fe7d6433ea7e5b2eb7fa Judgement_04222020_704043.zip
  57. - 75e0c0f122bd98f011223e87175f9729e3edd4fd66cacd3656feb233cced8852 Judgement_04222020_80188.zip
  58. - ed2687a6c20abf2e952d9ff522344a39fa25d7d5b3cad84576f05b15c4aeeee0 Judgement_04222020_8695470.zip
  59.  
  60. EXAMPLES OF EXTRACTED VBS FILES:
  61.  
  62. - a9112a8b6cf06710e7d4b60408865787f1d6e31c320e7b497618a0f88e0b92e3 Judgement_04222020_1546.vbs
  63. - 4b6417d713582630160b35658a921cebc37c1d44907d54e99ddd95e1e7d66d2f Judgement_04222020_1741.vbs
  64. - fabd563e131eac4798f612d08fb707a3839632eb763115e5f7ca4d1e24a02dec Judgement_04222020_2166.vbs
  65. - 7822b381dbc01d9625b2a3175fe16334c24e4ca22b337238def6206e08677d39 Judgement_04222020_250.vbs
  66. - 080b0bbff0628df551338a727121424293bcd9dda2864297fe520a283afc4d27 Judgement_04222020_290.vbs
  67. - 0e8c9cb759b247bd9dacddc7190d4b95b99610d077f73b56e62c97fe66b94d94 Judgement_04222020_4074.vbs
  68. - dea0a225cbc95b301ab070815c789fb84ee9611f89d55c8e28a1f8c8e4a5c590 Judgement_04222020_40954.vbs
  69. - ffdbfad447d2363a5827b2df5741845bdfb464b809ac8dc37bc63101f8e5ef6f Judgement_04222020_4853.vbs
  70.  
  71. EXAMPLES OF QAKBOT EXE FILES (ALL 1,950,208 BYTES):
  72.  
  73. - 78d4d6748dd89f7df5677df37d7aabfa459a080ec777edad87e0d9beab2e2c98 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  74. - 6a03748cc1b3aa9d28e1a0968b1f64c7fe63e527e9f047ca4a51855434897e36 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  75. - fcd62eaf45bac0417f7b27791f21c6867e4b77d95a33e52bda0d9f1f846264fa C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  76. - 16b82fdf31a59649f5340cabc8a2946b91c7e81c90a1a2e2026f66653043b91d C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  77. - 64031f76d624dbdc8a21deff4a4caccbec13138b1232fd77eddaf1e47c5a1302 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  78. - cb108c9977f7cc82b93aed9fbddefdbe356649bd4bfb4ce1f66c0ea8f8ace9d9 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  79. - 4b1889589fb591a56baf1c8f7751e13c856e9219db046acbdcb9b48211267d02 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  80. - 10e8c1693d5ac22b2d7c33235d080d027456e47535053a31b05e698bc07296f1 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
RAW Paste Data