malware_traffic

2020-04-23 - URLs/hashes for Qakbot (Qbot) spx103 files

Apr 23rd, 2020
2,805
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2020-04-23 (THURSDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX103, THE "/docs_[3 characters]/" WAVE
  2.  
  3. URLS FOR THE INITIAL ZIP ARCHIVES:
  4.  
  5. - hxxp://beta[.]vaspotrcko[.]rs/docs_01g/21744971/Judgement_04222020_21744971.zip
  6. - hxxp://beta[.]vaspotrcko[.]rs/docs_01g/Judgement_04222020_8695470.zip
  7. - hxxp://bgszone[.]ga/docs_e48/6292603/Judgement_04222020_6292603.zip
  8. - hxxp://bgszone[.]ga/docs_e48/Judgement_04222020_09992.zip
  9. - hxxp://bgszone[.]ga/docs_e48/Judgement_04222020_3842913.zip
  10. - hxxp://biacayipteknoloji[.]com/docs_h1x/Judgement_04222020_47141554.zip
  11. - hxxp://biacayipteknoloji[.]com/docs_h1x/Judgement_04222020_945063087.zip
  12. - hxxp://www[.]blueleed[.]com/wp-content/plugins/advanced-ads-genesis/docs_try/2391241/Judgement_04222020_2391241.zip
  13. - hxxp://dubook[.]co[.]in/docs_5et/864422649/Judgement_04222020_864422649.zip
  14. - hxxp://far-flower[.]mindsellers[.]ru/wp-content/plugins/apikey/docs_d64/054309/Judgement_04222020_054309.zip
  15. - hxxps://www[.]foxfennecs[.]com/wp-content/themes/calliope/docs_v72/084594017/Judgement_04222020_084594017.zip
  16. - hxxp://hasifria[.]net/wp-content/uploads/2020/04/docs_jsv/Judgement_04222020_65639.zip
  17. - hxxp://hlb[.]ae/docs_q22/Judgement_04222020_69120.zip
  18. - hxxps://jaincakes[.]xyz/docs_1o2/108393672/Judgement_04222020_108393672.zip
  19. - hxxps://jaincakes[.]xyz/docs_1o2/818263/Judgement_04222020_818263.zip
  20. - hxxps://jaincakes[.]xyz/docs_1o2/949025839/Judgement_04222020_949025839.zip
  21. - hxxp://ixlarge[.]net/docs_to2/Judgement_04222020_490035134.zip
  22. - hxxp://kastom[.]pw/docs_jvq/80188/Judgement_04222020_80188.zip
  23. - hxxp://ngoibitumsinhthai[.]com[.]vn/docs_asx/Judgement_04222020_819411.zip
  24. - hxxp://papaw[.]doudou1998[.]com/docs_y59/587518/Judgement_04222020_587518.zip
  25. - hxxp://papaw[.]doudou1998[.]com/docs_y59/Judgement_04222020_883379667.zip
  26. - hxxp://pinangcitygroup[.]asia/wp-content/uploads/2020/04/docs_cgj/704043/Judgement_04222020_704043.zip
  27. - hxxp://pinangcitygroup[.]asia/wp-content/uploads/2020/04/docs_cgj/Judgement_04222020_211032903.zip
  28. - hxxp://pinangcitygroup[.]asia/wp-content/uploads/2020/04/docs_cgj/Judgement_04222020_56507748.zip
  29. - hxxp://playvideo[.]site/docs_8kj/81588387/Judgement_04222020_81588387.zip
  30. - hxxp://playvideo[.]site/docs_8kj/Judgement_04222020_0736741.zip
  31. - hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/docs_tpm/250122449/Judgement_04222020_250122449.zip
  32. - hxxps://tepatitlan[.]gob[.]mx/cs/wp-content/themes/calliope/docs_tpm/Judgement_04222020_5460712.zip
  33. - hxxps://uvisionpk[.]com/wp/wp-content/themes/calliope/docs_4ru/6004556/Judgement_04222020_6004556.zip
  34. - hxxps://uvisionpk[.]com/wp/wp-content/themes/calliope/docs_4ru/Judgement_04222020_70525.zip
  35.  
  36. URLS FOR THE QAKBOT EXE FILES:
  37.  
  38. - NOTE: These were first noted by @lazyactivist192 on Twitter and posted at https://pastebin.com/7bYzetJF (see the link for more info)
  39. - hxxp://atn24live[.]com/spool/8888.png?uid=[base64 string]
  40. - hxxp://bg142[.]caliphs[.]my/spool/8888.png?uid=[base64 string]
  41. - hxxp://afsholdings[.]com[.]my/spool/8888.png?uid=[base64 string]
  42. - hxxp://alphapioneer[.]com/spool/8888.png?uid=[base64 string]
  43. - hxxp://kbzsa[.]cn/wp-content/plugins/apikey/spool/8888.png?uid=[base64 string]
  44.  
  45. NOTE:
  46.  
  47. - Malware samples below are available at: https://www.malware-traffic-analysis.net/2020/04/23/index.html
  48.  
  49. EXAMPLES OF DOWNLOADED ZIP ARCHIVES:
  50.  
  51. - 3ce476d7ed1f44b6e6ae7181995b03947b607f13795b0c29f1558106ee5c4de3 Judgement_04222020_211032903.zip
  52. - 9c73ad1cb1039e993d9c76758e5d83fd810a37be0149544b368239e7425dd0a0 Judgement_04222020_2391241.zip
  53. - 54e25795ac1a1c4633e1dec3e9b3cfb6051252bac4be4d86507ad36bc63bc9cd Judgement_04222020_3842913.zip
  54. - ad18b077b6f0d19d6e9d693a21c27cef7a9974ede5ac4045b7ec84f6d56af2e4 Judgement_04222020_6004556.zip
  55. - ea0f3e681d4a1313e766a3c452e269e4119050a2cf8678132c568676b7a4f88e Judgement_04222020_6292603.zip
  56. - 827cda6369854771aaed444aed5780da8984d9d294f2fe7d6433ea7e5b2eb7fa Judgement_04222020_704043.zip
  57. - 75e0c0f122bd98f011223e87175f9729e3edd4fd66cacd3656feb233cced8852 Judgement_04222020_80188.zip
  58. - ed2687a6c20abf2e952d9ff522344a39fa25d7d5b3cad84576f05b15c4aeeee0 Judgement_04222020_8695470.zip
  59.  
  60. EXAMPLES OF EXTRACTED VBS FILES:
  61.  
  62. - a9112a8b6cf06710e7d4b60408865787f1d6e31c320e7b497618a0f88e0b92e3 Judgement_04222020_1546.vbs
  63. - 4b6417d713582630160b35658a921cebc37c1d44907d54e99ddd95e1e7d66d2f Judgement_04222020_1741.vbs
  64. - fabd563e131eac4798f612d08fb707a3839632eb763115e5f7ca4d1e24a02dec Judgement_04222020_2166.vbs
  65. - 7822b381dbc01d9625b2a3175fe16334c24e4ca22b337238def6206e08677d39 Judgement_04222020_250.vbs
  66. - 080b0bbff0628df551338a727121424293bcd9dda2864297fe520a283afc4d27 Judgement_04222020_290.vbs
  67. - 0e8c9cb759b247bd9dacddc7190d4b95b99610d077f73b56e62c97fe66b94d94 Judgement_04222020_4074.vbs
  68. - dea0a225cbc95b301ab070815c789fb84ee9611f89d55c8e28a1f8c8e4a5c590 Judgement_04222020_40954.vbs
  69. - ffdbfad447d2363a5827b2df5741845bdfb464b809ac8dc37bc63101f8e5ef6f Judgement_04222020_4853.vbs
  70.  
  71. EXAMPLES OF QAKBOT EXE FILES (ALL 1,950,208 BYTES):
  72.  
  73. - 78d4d6748dd89f7df5677df37d7aabfa459a080ec777edad87e0d9beab2e2c98 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  74. - 6a03748cc1b3aa9d28e1a0968b1f64c7fe63e527e9f047ca4a51855434897e36 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  75. - fcd62eaf45bac0417f7b27791f21c6867e4b77d95a33e52bda0d9f1f846264fa C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  76. - 16b82fdf31a59649f5340cabc8a2946b91c7e81c90a1a2e2026f66653043b91d C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  77. - 64031f76d624dbdc8a21deff4a4caccbec13138b1232fd77eddaf1e47c5a1302 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  78. - cb108c9977f7cc82b93aed9fbddefdbe356649bd4bfb4ce1f66c0ea8f8ace9d9 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  79. - 4b1889589fb591a56baf1c8f7751e13c856e9219db046acbdcb9b48211267d02 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  80. - 10e8c1693d5ac22b2d7c33235d080d027456e47535053a31b05e698bc07296f1 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
RAW Paste Data

Adblocker detected! Please consider disabling it...

We've detected AdBlock Plus or some other adblocking software preventing Pastebin.com from fully loading.

We don't have any obnoxious sound, or popup ads, we actively block these annoying types of ads!

Please add Pastebin.com to your ad blocker whitelist or disable your adblocking software.

×