Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 2020-04-17 (FRIDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX99, THE "/DIFFER/" WAVE
- URLS FOR THE INITIAL ZIP ARCHIVES FROM MALSPAM:
- - hxxp://420hempizone[.]co/differ/82386.zip
- - hxxps://420hempizone[.]co/differ/129091/129091.zip
- - hxxps://420hempizone[.]co/differ/18188/18188.zip
- - hxxps://bavlcentral[.]org/differ/50208/50208.zip
- - hxxps://besthack[.]co/differ/557687/557687.zip
- - hxxps://besthack[.]co/differ/6053744/6053744.zip
- - hxxps://besthack[.]co/differ/9710336/9710336.zip
- - hxxps://bybysunday[.]com/differ/09997/09997.zip
- - hxxps://bybysunday[.]com/differ/7076923.zip
- - hxxps://clario[.]biz/differ/24093/24093.zip
- - hxxps://clario[.]biz/differ/47796/47796.zip
- - hxxps://clario[.]biz/differ/83561.zip
- - hxxps://compesat[.]com/differ/21962/21962.zip
- - hxxps://compesat[.]com/differ/106172/106172.zip
- - hxxps://crudenergyllc[.]com/differ/453657.zip
- - hxxps://crudenergyllc[.]com/differ/925333/925333.zip
- - hxxps://digiovanniconsultants[.]com/differ/62499748/62499748.zip
- - hxxps://digivisor[.]website/differ/16692/16692.zip
- - hxxps://digivisor[.]website/differ/628212971/628212971.zip
- - hxxps://digivisor[.]website/differ/63176025.zip
- - hxxps://fairyqueenstore[.]com/differ/2164939.zip
- - hxxps://fairyqueenstore[.]com/differ/5366237.zip
- - hxxps://fairyqueenstore[.]com/differ/912544/912544.zip
- - hxxps://film4k[.]ga/differ/046130044/046130044.zip
- - hxxps://film4k[.]ga/differ/20586.zip
- - hxxps://film4k[.]ga/differ/20586.zip*
- - hxxps://fine[.]black/differ/49363504/49363504.zip
- - hxxps://glitchexotika[.]com/differ/947908.zip
- - hxxps://globaloilsupply[.]co/differ/14608.zip
- - hxxps://globaloilsupply[.]co/differ/46570680.zip
- - hxxps://globaloilsupply[.]co/differ/470876/470876.zip
- - hxxps://halotelco[.]vip/differ/70955.zip
- - hxxp://hamda[.]alimarket24[.]website/differ/078178/078178.zip
- - hxxp://heartofvegasfans[.]club/differ/4001095/4001095.zip
- - hxxps://heartofvegasfans[.]club/differ/94809652/94809652.zip
- - hxxps://iphonewin[.]website/differ/665206.zip
- - hxxps://kukumbara[.]com/differ/5570258/5570258.zip
- - hxxps://musearttherapy[.]com/differ/264676.zip
- - hxxps://musearttherapy[.]com/differ/327336/327336.zip
- - hxxps://musearttherapy[.]com/differ/645441.zip
- - hxxps://oneviktory[.]com/differ/6655170.zip
- - hxxps://onyourmarkmindsetgo[.]com/differ/1313258/1313258.zip
- - hxxps://onyourmarkmindsetgo[.]com/differ/84214241.zip
- - hxxps://qualitygolfbags[.]com/differ/45335.zip
- - hxxp://quoteslevel[.]com/differ/6864772/6864772.zip
- - hxxps://quoteslevel[.]com/differ/73053607/73053607.zip
- - hxxps://quoteslevel[.]com/differ/773147837.zip
- - hxxp://sayiteducation[.]com/differ/23338/23338.zip
- - hxxps://sayiteducation[.]com/differ/293127445.zip
- - hxxps://sayiteducation[.]com/differ/354318294/354318294.zip
- - hxxps://sayiteducation[.]com/differ/666217.zip
- - hxxps://sayiteducation[.]com/differ/6924025.zip
- - hxxps://sayiteducation[.]com/differ/99978717/99978717.zip
- - hxxps://suhailikasmat[.]com/differ/57026627/57026627.zip
- - hxxps://sweetrsnd[.]com/differ/30560.zip
- - hxxps://theneews[.]us/differ/323232527.zip
- - hxxps://theneews[.]us/differ/021906/021906.zip
- - hxxps://theneews[.]us/differ/888441/888441.zip
- - hxxps://thepyramids[.]nl/differ/60636/60636.zip
- - hxxps://thepyramids[.]nl/differ/61456.zip
- - hxxps://thepyramids[.]nl/differ/894405/894405.zip
- - hxxps://thornadops[.]com/differ/473793/473793.zip
- - hxxps://thornadops[.]com/differ/0528300/0528300.zip
- - hxxps://wahat-apps[.]com/differ/2934245.zip
- URLS FOR THE QAKBOT EXE FILES:
- - NOTE: These were first noted by @lazyactivist192 on Twitter and posted at https://pastebin.com/NueGcP8G (see the link for more info)
- - hxxp://paceldelivery[.]express/differ/999999[.]png?uid=[base64 string]
- - hxxp://greindustry[.]com/differ/999999[.]png?uid=[base64 string]
- - hxxp://newsfee[.]info/differ/999999[.]png?uid=[base64 string]
- - hxxp://testing[.]web-x[.]io/differ/999999[.]png?uid=[base64 string]
- - hxxp://bigssearch[[.]com/differ/999999[.]png?uid=[base64 string]
- - hxxp://a[.]adventh[.]org/images/105[.]png?uid=[base64 string]
- EXAMPLES OF DOWNLOADED ZIP ARCHIVES:
- - 1362b15776a51ba90cbaeddba301de13345dfbc50549cd8ac95118fe90d8be3e 2164939.zip
- - 8e44190ca342a72ffc3c919996891276d9cc47c84a1c3914e6fc053ca599bc0f 82386.zip
- - bfebbca82043ac2da982bc6134bf09814152cee23e7bf51f931185dc3d02fb2e 0140012.zip
- - eff8c821f93d368a8ac108901ae94b1cb820c7eec58262433e1e35dc81e38e62 50208.zip
- EXAMPLES OF EXTRACTED VBS FILES:
- - 2cc5fffeaa8443c4a5b556e5acebf502d0a9dc4b5352ba5b00ac109c0a13068c NUM_71700.vbs
- - 3929cbd1f794e5f3d152c69cc130f408cb45091cf69bd02e02ed2971cdff0f2f NUM_54386.vbs
- - 39c9e73b1410ac9c91f418084bb32871cf4464879aabdb35a5815dcfa012660c NUM_353.vbs
- - aa1fc1bd0c7f6155f5138662663211233e3e0cacf5ab5ab3bf97c54c20b48ed9 NUM_50905.vbs
- EXAMPLES OF QAKBOT EXE FILES (ALL 2,295,808 bytes):
- - 07f428982f0ff41bbb792f037b7c3168772e73603c2ad3354a1d1c0980c63ed6 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- - 0e9828d862f7ce0bc287ed2ee548befaad6ffd4eecc6a753f137e68221b78518 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- - 4fa643894b181647d6181697730df99cbda1a82e28299920ecd1ab0fae2f679b 999999.png
- - a37da79053a196bce0c98dbcec26585d09613210b4e06b5e2524971c1feb2ff4 999999.png
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement