Ledger Nano X - The secure hardware wallet
SHARE
TWEET

2020-04-17 - URLs/hashes for Qakbot (Qbot) spx99 files

malware_traffic Apr 17th, 2020 (edited) 800 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2020-04-17 (FRIDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX99, THE "/DIFFER/" WAVE
  2.  
  3. URLS FOR THE INITIAL ZIP ARCHIVES FROM MALSPAM:
  4.  
  5. - hxxp://420hempizone[.]co/differ/82386.zip
  6. - hxxps://420hempizone[.]co/differ/129091/129091.zip
  7. - hxxps://420hempizone[.]co/differ/18188/18188.zip
  8. - hxxps://bavlcentral[.]org/differ/50208/50208.zip
  9. - hxxps://besthack[.]co/differ/557687/557687.zip
  10. - hxxps://besthack[.]co/differ/6053744/6053744.zip
  11. - hxxps://besthack[.]co/differ/9710336/9710336.zip
  12. - hxxps://bybysunday[.]com/differ/09997/09997.zip
  13. - hxxps://bybysunday[.]com/differ/7076923.zip
  14. - hxxps://clario[.]biz/differ/24093/24093.zip
  15. - hxxps://clario[.]biz/differ/47796/47796.zip
  16. - hxxps://clario[.]biz/differ/83561.zip
  17. - hxxps://compesat[.]com/differ/21962/21962.zip
  18. - hxxps://compesat[.]com/differ/106172/106172.zip
  19. - hxxps://crudenergyllc[.]com/differ/453657.zip
  20. - hxxps://crudenergyllc[.]com/differ/925333/925333.zip
  21. - hxxps://digiovanniconsultants[.]com/differ/62499748/62499748.zip
  22. - hxxps://digivisor[.]website/differ/16692/16692.zip
  23. - hxxps://digivisor[.]website/differ/628212971/628212971.zip
  24. - hxxps://digivisor[.]website/differ/63176025.zip
  25. - hxxps://fairyqueenstore[.]com/differ/2164939.zip
  26. - hxxps://fairyqueenstore[.]com/differ/5366237.zip
  27. - hxxps://fairyqueenstore[.]com/differ/912544/912544.zip
  28. - hxxps://film4k[.]ga/differ/046130044/046130044.zip
  29. - hxxps://film4k[.]ga/differ/20586.zip
  30. - hxxps://film4k[.]ga/differ/20586.zip*
  31. - hxxps://fine[.]black/differ/49363504/49363504.zip
  32. - hxxps://glitchexotika[.]com/differ/947908.zip
  33. - hxxps://globaloilsupply[.]co/differ/14608.zip
  34. - hxxps://globaloilsupply[.]co/differ/46570680.zip
  35. - hxxps://globaloilsupply[.]co/differ/470876/470876.zip
  36. - hxxps://halotelco[.]vip/differ/70955.zip
  37. - hxxp://hamda[.]alimarket24[.]website/differ/078178/078178.zip
  38. - hxxp://heartofvegasfans[.]club/differ/4001095/4001095.zip
  39. - hxxps://heartofvegasfans[.]club/differ/94809652/94809652.zip
  40. - hxxps://iphonewin[.]website/differ/665206.zip
  41. - hxxps://kukumbara[.]com/differ/5570258/5570258.zip
  42. - hxxps://musearttherapy[.]com/differ/264676.zip
  43. - hxxps://musearttherapy[.]com/differ/327336/327336.zip
  44. - hxxps://musearttherapy[.]com/differ/645441.zip
  45. - hxxps://oneviktory[.]com/differ/6655170.zip
  46. - hxxps://onyourmarkmindsetgo[.]com/differ/1313258/1313258.zip
  47. - hxxps://onyourmarkmindsetgo[.]com/differ/84214241.zip
  48. - hxxps://qualitygolfbags[.]com/differ/45335.zip
  49. - hxxp://quoteslevel[.]com/differ/6864772/6864772.zip
  50. - hxxps://quoteslevel[.]com/differ/73053607/73053607.zip
  51. - hxxps://quoteslevel[.]com/differ/773147837.zip
  52. - hxxp://sayiteducation[.]com/differ/23338/23338.zip
  53. - hxxps://sayiteducation[.]com/differ/293127445.zip
  54. - hxxps://sayiteducation[.]com/differ/354318294/354318294.zip
  55. - hxxps://sayiteducation[.]com/differ/666217.zip
  56. - hxxps://sayiteducation[.]com/differ/6924025.zip
  57. - hxxps://sayiteducation[.]com/differ/99978717/99978717.zip
  58. - hxxps://suhailikasmat[.]com/differ/57026627/57026627.zip
  59. - hxxps://sweetrsnd[.]com/differ/30560.zip
  60. - hxxps://theneews[.]us/differ/323232527.zip
  61. - hxxps://theneews[.]us/differ/021906/021906.zip
  62. - hxxps://theneews[.]us/differ/888441/888441.zip
  63. - hxxps://thepyramids[.]nl/differ/60636/60636.zip
  64. - hxxps://thepyramids[.]nl/differ/61456.zip
  65. - hxxps://thepyramids[.]nl/differ/894405/894405.zip
  66. - hxxps://thornadops[.]com/differ/473793/473793.zip
  67. - hxxps://thornadops[.]com/differ/0528300/0528300.zip
  68. - hxxps://wahat-apps[.]com/differ/2934245.zip
  69.  
  70. URLS FOR THE QAKBOT EXE FILES:
  71.  
  72. - NOTE: These were first noted by @lazyactivist192 on Twitter and posted at https://pastebin.com/NueGcP8G (see the link for more info)
  73. - hxxp://paceldelivery[.]express/differ/999999[.]png?uid=[base64 string]
  74. - hxxp://greindustry[.]com/differ/999999[.]png?uid=[base64 string]
  75. - hxxp://newsfee[.]info/differ/999999[.]png?uid=[base64 string]
  76. - hxxp://testing[.]web-x[.]io/differ/999999[.]png?uid=[base64 string]
  77. - hxxp://bigssearch[[.]com/differ/999999[.]png?uid=[base64 string]
  78. - hxxp://a[.]adventh[.]org/images/105[.]png?uid=[base64 string]
  79.  
  80. EXAMPLES OF DOWNLOADED ZIP ARCHIVES:
  81.  
  82. - 1362b15776a51ba90cbaeddba301de13345dfbc50549cd8ac95118fe90d8be3e  2164939.zip
  83. - 8e44190ca342a72ffc3c919996891276d9cc47c84a1c3914e6fc053ca599bc0f  82386.zip
  84. - bfebbca82043ac2da982bc6134bf09814152cee23e7bf51f931185dc3d02fb2e  0140012.zip
  85. - eff8c821f93d368a8ac108901ae94b1cb820c7eec58262433e1e35dc81e38e62  50208.zip
  86.  
  87. EXAMPLES OF EXTRACTED VBS FILES:
  88.  
  89. - 2cc5fffeaa8443c4a5b556e5acebf502d0a9dc4b5352ba5b00ac109c0a13068c  NUM_71700.vbs
  90. - 3929cbd1f794e5f3d152c69cc130f408cb45091cf69bd02e02ed2971cdff0f2f  NUM_54386.vbs
  91. - 39c9e73b1410ac9c91f418084bb32871cf4464879aabdb35a5815dcfa012660c  NUM_353.vbs
  92. - aa1fc1bd0c7f6155f5138662663211233e3e0cacf5ab5ab3bf97c54c20b48ed9  NUM_50905.vbs
  93.  
  94. EXAMPLES OF QAKBOT EXE FILES (ALL 2,295,808 bytes):
  95.  
  96. - 07f428982f0ff41bbb792f037b7c3168772e73603c2ad3354a1d1c0980c63ed6  C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  97. - 0e9828d862f7ce0bc287ed2ee548befaad6ffd4eecc6a753f137e68221b78518  C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  98. - 4fa643894b181647d6181697730df99cbda1a82e28299920ecd1ab0fae2f679b  999999.png
  99. - a37da79053a196bce0c98dbcec26585d09613210b4e06b5e2524971c1feb2ff4  999999.png
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top