malware_traffic

2020-02-03 - Malspam pushing Qbot (Qakbot)

Feb 3rd, 2020
2,940
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. X-Originating-Ip: [69.89.23.12]
  2. Authentication-Results: [removed]; iprev=pass policy.iprev="69.89.23.12"; spf=softfail smtp.mailfrom="[removed]@gmail.com" smtp.helo="qproxy6-pub.mail.unifiedlayer.com"; dkim=none (message not signed) header.d=none; dmarc=fail (p=none; dis=none) header.from=gmail.com
  3. Received: from [69.89.23.12] ([69.89.23.12:34027] helo=qproxy6-pub.mail.unifiedlayer.com)
  4. by [removed] from (envelope-from <[removed]@gmail.com>) [removed];
  5. Mon, 03 Feb 2020 16:56:06 -0500
  6. Received: from cmgw15.unifiedlayer.com (unknown [10.9.0.15])
  7. by qproxy6.mail.unifiedlayer.com (Postfix) with ESMTP id E83FE1404BF
  8. for [removed]; Mon, 3 Feb 2020 14:56:05 -0700 (MST)
  9. Received: from cp-36.webhostbox.net ([208.91.198.26])
  10. by cmsmtp with ESMTP
  11. id yjhNixdDtPmYNyjhNiuk0t; Mon, 03 Feb 2020 14:56:05 -0700
  12. X-Authority-Reason: nr=8
  13. X-Authority-Reason: s=1
  14. X-Authority-Analysis: v=2.3 cv=VPLzYeHX c=1 sm=1 tr=0
  15. a=zuoMOre9QfZ7cZC9M+z1fQ==:117 a=PjhB0ulp83wVf6YMe7WlkQ==:17
  16. a=x7bEGLp0ZPQA:10:nop_freemail a=v8Vmw5Ot0DIA:10:mobile_from_freemail
  17. a=l697ptgUJYAA:10:nop_rcvd_month_year
  18. a=9oZjC5pqDmIA:10:endurance_base64_authed_username_1 a=N95aBKmVAAAA:8
  19. a=pGLkceISAAAA:8 a=2LXBR7jRaI7ZH76WDZEA:9 a=QEXdDO2ut3YA:10:nop_charset_2
  20. a=NrkkNYuO57IA:10:demote_hacked_domain_41
  21. a=-FEs8UIgK8oA:10:nop_fastflux_domain_1 a=NWVoK91CQyQA:10:nop_rescan
  22. a=iwH7Ti0SHlN0kuGyyLAA:9 a=lU5O8suG5LZdY1eH:21 a=AIVEieilCOxbAvWMxLZ3:22
  23. Received: from 50-248-175-249-static.hfc.comcastbusiness.net ([50.248.175.249]:6066 helo=localhost)
  24. by cp-36.webhostbox.net with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
  25. (Exim 4.92)
  26. (envelope-from <[removed]@gmail.com>)
  27. id 1iyjhM-00BvfM-P1
  28. for [removed]; Mon, 03 Feb 2020 21:56:05 +0000
  29. Date: Mon, 03 Feb 2020 21:51:53 +0000
  30. From: [removed]
  31. To: "[removed]
  32. Message-ID: <32f82d88-aae7-41ca-8c0c-f85e884bc4be@local>
  33. Subject: Re: Accident with the Porsche
  34. Mime-Version: 1.0
  35. Content-Type: multipart/alternative;
  36. boundary="--==_mimepart_5e3895f98ace6_178c2af392f41964181d"
  37. Content-Transfer-Encoding: 7bit
  38.  
  39.  
  40. ----==_mimepart_5e3895f98ace6_178c2af392f41964181d
  41. Content-Type: text/plain;
  42. charset=UTF-8
  43. Content-Transfer-Encoding: quoted-printable
  44.  
  45. =0D
  46. Hello,=0D
  47. =0D
  48. I=E2=80=99ve attached the report below, just need you to confirm that it=E2=
  49. =80=99s good to go. Please take a look and get back to me.=0D
  50. =0D
  51. ATTACHMENT DOCUMENT hxxp://santedeplus[.]info/wp-content/uploads/2020/02/en=
  52. ding/1582820/1582820.zip=0D
  53. =0D
  54. =0D
  55. Thank you=0D
  56. =0D
  57. =0D
  58. =0D
  59. =0D
  60. =0D
  61. > [removed],=0D
  62. > =0D
  63. > Yes, it was the William=EF=BF=BDs Porsche. The accident was entirely m=
  64. y fault, though. I didn=EF=BF=BDt check my blind spot before changing la=
  65. nes.=0D
  66. > =0D
  67. > - Ronald=0D
  68. > =0D
  69. > > On Jun 26, 2019, at 12:26 PM, [removed] <[removed]@gmail.com> wrote:=0D
  70. > > =0D
  71. > > Ronald,=0D
  72. > > =0D
  73. > > Rumor has it your Nissan was involved in a traffic accident with the=0D=
  74. =0D
  75. > > Porsche. And the Porsche was driven by William in accounting. Was=0D=
  76. =0D
  77. > > this true?=0D
  78. > > =0D
  79. > > - [removed]=
  80.  
  81. ----==_mimepart_5e3895f98ace6_178c2af392f41964181d
  82. Content-Type: text/html;
  83. charset=UTF-8
  84. Content-Transfer-Encoding: quoted-printable
  85.  
  86. <br />Hello,<br /><br />I&rsquo;ve attached the report below, just need y=
  87. ou to confirm that it&rsquo;s good to go. Please take a look and get back=
  88. to me.<br /><br /><a href=3D"hxxp://santedeplus[.]info/wp-content/upload=
  89. s/2020/02/ending/1582820/1582820.zip">ATTACHMENT DOCUMENT</a><br /><br />=
  90. <br />Thank you<br /><br /><br/><br/><br><blockquote type=3D"cite"><i>[re=
  91. moved]</i>,<br/><br/>Yes, it was the William&rsquo;s Porsche. The accide=
  92. nt was entirely my fault, though. I didn&rsquo;t check my blind spot bef=
  93. ore changing lanes.<br/><br/>- Ronald<br/><br/>> On Jun 26, 2019, at 12:2=
  94. 6 PM, <i>[removed]</i> <<i>[removed]</i>@gmail.com> wrote:<br/>> <br/>> R=
  95. onald,<br/>> <br/>> Rumor has it your Nissan was involved in a traffic a=
  96. ccident with the<br/>> Porsche. And the Porsche was driven by William in=
  97. accounting. Was<br/>> this true?<br/>> <br/>> - <i>[removed]</i></block=
  98. quote>=
  99.  
  100. ----==_mimepart_5e3895f98ace6_178c2af392f41964181d--
RAW Paste Data