malware_traffic

2020-04-17 - URLs/hashes for Qakbot (Qbot) spx99 files

Apr 17th, 2020
1,386
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. 2020-04-17 (FRIDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX99, THE "/DIFFER/" WAVE
  2.  
  3. URLS FOR THE INITIAL ZIP ARCHIVES FROM MALSPAM:
  4.  
  5. - hxxp://420hempizone[.]co/differ/82386.zip
  6. - hxxps://420hempizone[.]co/differ/129091/129091.zip
  7. - hxxps://420hempizone[.]co/differ/18188/18188.zip
  8. - hxxps://bavlcentral[.]org/differ/50208/50208.zip
  9. - hxxps://besthack[.]co/differ/557687/557687.zip
  10. - hxxps://besthack[.]co/differ/6053744/6053744.zip
  11. - hxxps://besthack[.]co/differ/9710336/9710336.zip
  12. - hxxps://bybysunday[.]com/differ/09997/09997.zip
  13. - hxxps://bybysunday[.]com/differ/7076923.zip
  14. - hxxps://clario[.]biz/differ/24093/24093.zip
  15. - hxxps://clario[.]biz/differ/47796/47796.zip
  16. - hxxps://clario[.]biz/differ/83561.zip
  17. - hxxps://compesat[.]com/differ/21962/21962.zip
  18. - hxxps://compesat[.]com/differ/106172/106172.zip
  19. - hxxps://crudenergyllc[.]com/differ/453657.zip
  20. - hxxps://crudenergyllc[.]com/differ/925333/925333.zip
  21. - hxxps://digiovanniconsultants[.]com/differ/62499748/62499748.zip
  22. - hxxps://digivisor[.]website/differ/16692/16692.zip
  23. - hxxps://digivisor[.]website/differ/628212971/628212971.zip
  24. - hxxps://digivisor[.]website/differ/63176025.zip
  25. - hxxps://fairyqueenstore[.]com/differ/2164939.zip
  26. - hxxps://fairyqueenstore[.]com/differ/5366237.zip
  27. - hxxps://fairyqueenstore[.]com/differ/912544/912544.zip
  28. - hxxps://film4k[.]ga/differ/046130044/046130044.zip
  29. - hxxps://film4k[.]ga/differ/20586.zip
  30. - hxxps://film4k[.]ga/differ/20586.zip*
  31. - hxxps://fine[.]black/differ/49363504/49363504.zip
  32. - hxxps://glitchexotika[.]com/differ/947908.zip
  33. - hxxps://globaloilsupply[.]co/differ/14608.zip
  34. - hxxps://globaloilsupply[.]co/differ/46570680.zip
  35. - hxxps://globaloilsupply[.]co/differ/470876/470876.zip
  36. - hxxps://halotelco[.]vip/differ/70955.zip
  37. - hxxp://hamda[.]alimarket24[.]website/differ/078178/078178.zip
  38. - hxxp://heartofvegasfans[.]club/differ/4001095/4001095.zip
  39. - hxxps://heartofvegasfans[.]club/differ/94809652/94809652.zip
  40. - hxxps://iphonewin[.]website/differ/665206.zip
  41. - hxxps://kukumbara[.]com/differ/5570258/5570258.zip
  42. - hxxps://musearttherapy[.]com/differ/264676.zip
  43. - hxxps://musearttherapy[.]com/differ/327336/327336.zip
  44. - hxxps://musearttherapy[.]com/differ/645441.zip
  45. - hxxps://oneviktory[.]com/differ/6655170.zip
  46. - hxxps://onyourmarkmindsetgo[.]com/differ/1313258/1313258.zip
  47. - hxxps://onyourmarkmindsetgo[.]com/differ/84214241.zip
  48. - hxxps://qualitygolfbags[.]com/differ/45335.zip
  49. - hxxp://quoteslevel[.]com/differ/6864772/6864772.zip
  50. - hxxps://quoteslevel[.]com/differ/73053607/73053607.zip
  51. - hxxps://quoteslevel[.]com/differ/773147837.zip
  52. - hxxp://sayiteducation[.]com/differ/23338/23338.zip
  53. - hxxps://sayiteducation[.]com/differ/293127445.zip
  54. - hxxps://sayiteducation[.]com/differ/354318294/354318294.zip
  55. - hxxps://sayiteducation[.]com/differ/666217.zip
  56. - hxxps://sayiteducation[.]com/differ/6924025.zip
  57. - hxxps://sayiteducation[.]com/differ/99978717/99978717.zip
  58. - hxxps://suhailikasmat[.]com/differ/57026627/57026627.zip
  59. - hxxps://sweetrsnd[.]com/differ/30560.zip
  60. - hxxps://theneews[.]us/differ/323232527.zip
  61. - hxxps://theneews[.]us/differ/021906/021906.zip
  62. - hxxps://theneews[.]us/differ/888441/888441.zip
  63. - hxxps://thepyramids[.]nl/differ/60636/60636.zip
  64. - hxxps://thepyramids[.]nl/differ/61456.zip
  65. - hxxps://thepyramids[.]nl/differ/894405/894405.zip
  66. - hxxps://thornadops[.]com/differ/473793/473793.zip
  67. - hxxps://thornadops[.]com/differ/0528300/0528300.zip
  68. - hxxps://wahat-apps[.]com/differ/2934245.zip
  69.  
  70. URLS FOR THE QAKBOT EXE FILES:
  71.  
  72. - NOTE: These were first noted by @lazyactivist192 on Twitter and posted at https://pastebin.com/NueGcP8G (see the link for more info)
  73. - hxxp://paceldelivery[.]express/differ/999999[.]png?uid=[base64 string]
  74. - hxxp://greindustry[.]com/differ/999999[.]png?uid=[base64 string]
  75. - hxxp://newsfee[.]info/differ/999999[.]png?uid=[base64 string]
  76. - hxxp://testing[.]web-x[.]io/differ/999999[.]png?uid=[base64 string]
  77. - hxxp://bigssearch[[.]com/differ/999999[.]png?uid=[base64 string]
  78. - hxxp://a[.]adventh[.]org/images/105[.]png?uid=[base64 string]
  79.  
  80. EXAMPLES OF DOWNLOADED ZIP ARCHIVES:
  81.  
  82. - 1362b15776a51ba90cbaeddba301de13345dfbc50549cd8ac95118fe90d8be3e 2164939.zip
  83. - 8e44190ca342a72ffc3c919996891276d9cc47c84a1c3914e6fc053ca599bc0f 82386.zip
  84. - bfebbca82043ac2da982bc6134bf09814152cee23e7bf51f931185dc3d02fb2e 0140012.zip
  85. - eff8c821f93d368a8ac108901ae94b1cb820c7eec58262433e1e35dc81e38e62 50208.zip
  86.  
  87. EXAMPLES OF EXTRACTED VBS FILES:
  88.  
  89. - 2cc5fffeaa8443c4a5b556e5acebf502d0a9dc4b5352ba5b00ac109c0a13068c NUM_71700.vbs
  90. - 3929cbd1f794e5f3d152c69cc130f408cb45091cf69bd02e02ed2971cdff0f2f NUM_54386.vbs
  91. - 39c9e73b1410ac9c91f418084bb32871cf4464879aabdb35a5815dcfa012660c NUM_353.vbs
  92. - aa1fc1bd0c7f6155f5138662663211233e3e0cacf5ab5ab3bf97c54c20b48ed9 NUM_50905.vbs
  93.  
  94. EXAMPLES OF QAKBOT EXE FILES (ALL 2,295,808 bytes):
  95.  
  96. - 07f428982f0ff41bbb792f037b7c3168772e73603c2ad3354a1d1c0980c63ed6 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  97. - 0e9828d862f7ce0bc287ed2ee548befaad6ffd4eecc6a753f137e68221b78518 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
  98. - 4fa643894b181647d6181697730df99cbda1a82e28299920ecd1ab0fae2f679b 999999.png
  99. - a37da79053a196bce0c98dbcec26585d09613210b4e06b5e2524971c1feb2ff4 999999.png
RAW Paste Data