2020-04-17 - URLs/hashes for Qakbot (Qbot) spx99 files

2020-04-17 (FRIDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX99, THE "/DIFFER/" WAVE

URLS FOR THE INITIAL ZIP ARCHIVES FROM MALSPAM:

- hxxp://420hempizone[.]co/differ/82386.zip
- hxxps://420hempizone[.]co/differ/129091/129091.zip
- hxxps://420hempizone[.]co/differ/18188/18188.zip
- hxxps://bavlcentral[.]org/differ/50208/50208.zip
- hxxps://besthack[.]co/differ/557687/557687.zip
- hxxps://besthack[.]co/differ/6053744/6053744.zip
- hxxps://besthack[.]co/differ/9710336/9710336.zip
- hxxps://bybysunday[.]com/differ/09997/09997.zip
- hxxps://bybysunday[.]com/differ/7076923.zip
- hxxps://clario[.]biz/differ/24093/24093.zip
- hxxps://clario[.]biz/differ/47796/47796.zip
- hxxps://clario[.]biz/differ/83561.zip
- hxxps://compesat[.]com/differ/21962/21962.zip
- hxxps://compesat[.]com/differ/106172/106172.zip
- hxxps://crudenergyllc[.]com/differ/453657.zip
- hxxps://crudenergyllc[.]com/differ/925333/925333.zip
- hxxps://digiovanniconsultants[.]com/differ/62499748/62499748.zip
- hxxps://digivisor[.]website/differ/16692/16692.zip
- hxxps://digivisor[.]website/differ/628212971/628212971.zip
- hxxps://digivisor[.]website/differ/63176025.zip
- hxxps://fairyqueenstore[.]com/differ/2164939.zip
- hxxps://fairyqueenstore[.]com/differ/5366237.zip
- hxxps://fairyqueenstore[.]com/differ/912544/912544.zip
- hxxps://film4k[.]ga/differ/046130044/046130044.zip
- hxxps://film4k[.]ga/differ/20586.zip
- hxxps://film4k[.]ga/differ/20586.zip*
- hxxps://fine[.]black/differ/49363504/49363504.zip
- hxxps://glitchexotika[.]com/differ/947908.zip
- hxxps://globaloilsupply[.]co/differ/14608.zip
- hxxps://globaloilsupply[.]co/differ/46570680.zip
- hxxps://globaloilsupply[.]co/differ/470876/470876.zip
- hxxps://halotelco[.]vip/differ/70955.zip
- hxxp://hamda[.]alimarket24[.]website/differ/078178/078178.zip
- hxxp://heartofvegasfans[.]club/differ/4001095/4001095.zip
- hxxps://heartofvegasfans[.]club/differ/94809652/94809652.zip
- hxxps://iphonewin[.]website/differ/665206.zip
- hxxps://kukumbara[.]com/differ/5570258/5570258.zip
- hxxps://musearttherapy[.]com/differ/264676.zip
- hxxps://musearttherapy[.]com/differ/327336/327336.zip
- hxxps://musearttherapy[.]com/differ/645441.zip
- hxxps://oneviktory[.]com/differ/6655170.zip
- hxxps://onyourmarkmindsetgo[.]com/differ/1313258/1313258.zip
- hxxps://onyourmarkmindsetgo[.]com/differ/84214241.zip
- hxxps://qualitygolfbags[.]com/differ/45335.zip
- hxxp://quoteslevel[.]com/differ/6864772/6864772.zip
- hxxps://quoteslevel[.]com/differ/73053607/73053607.zip
- hxxps://quoteslevel[.]com/differ/773147837.zip
- hxxp://sayiteducation[.]com/differ/23338/23338.zip
- hxxps://sayiteducation[.]com/differ/293127445.zip
- hxxps://sayiteducation[.]com/differ/354318294/354318294.zip
- hxxps://sayiteducation[.]com/differ/666217.zip
- hxxps://sayiteducation[.]com/differ/6924025.zip
- hxxps://sayiteducation[.]com/differ/99978717/99978717.zip
- hxxps://suhailikasmat[.]com/differ/57026627/57026627.zip
- hxxps://sweetrsnd[.]com/differ/30560.zip
- hxxps://theneews[.]us/differ/323232527.zip
- hxxps://theneews[.]us/differ/021906/021906.zip
- hxxps://theneews[.]us/differ/888441/888441.zip
- hxxps://thepyramids[.]nl/differ/60636/60636.zip
- hxxps://thepyramids[.]nl/differ/61456.zip
- hxxps://thepyramids[.]nl/differ/894405/894405.zip
- hxxps://thornadops[.]com/differ/473793/473793.zip
- hxxps://thornadops[.]com/differ/0528300/0528300.zip
- hxxps://wahat-apps[.]com/differ/2934245.zip

URLS FOR THE QAKBOT EXE FILES:

- NOTE: These were first noted by @lazyactivist192 on Twitter and posted at https://pastebin.com/NueGcP8G (see the link for more info)
- hxxp://paceldelivery[.]express/differ/999999[.]png?uid=[base64 string]
- hxxp://greindustry[.]com/differ/999999[.]png?uid=[base64 string]
- hxxp://newsfee[.]info/differ/999999[.]png?uid=[base64 string]
- hxxp://testing[.]web-x[.]io/differ/999999[.]png?uid=[base64 string]
- hxxp://bigssearch[[.]com/differ/999999[.]png?uid=[base64 string]
- hxxp://a[.]adventh[.]org/images/105[.]png?uid=[base64 string]

EXAMPLES OF DOWNLOADED ZIP ARCHIVES:

- 1362b15776a51ba90cbaeddba301de13345dfbc50549cd8ac95118fe90d8be3e  2164939.zip
- 8e44190ca342a72ffc3c919996891276d9cc47c84a1c3914e6fc053ca599bc0f  82386.zip
- bfebbca82043ac2da982bc6134bf09814152cee23e7bf51f931185dc3d02fb2e  0140012.zip
- eff8c821f93d368a8ac108901ae94b1cb820c7eec58262433e1e35dc81e38e62  50208.zip

EXAMPLES OF EXTRACTED VBS FILES:

- 2cc5fffeaa8443c4a5b556e5acebf502d0a9dc4b5352ba5b00ac109c0a13068c  NUM_71700.vbs
- 3929cbd1f794e5f3d152c69cc130f408cb45091cf69bd02e02ed2971cdff0f2f  NUM_54386.vbs
- 39c9e73b1410ac9c91f418084bb32871cf4464879aabdb35a5815dcfa012660c  NUM_353.vbs
- aa1fc1bd0c7f6155f5138662663211233e3e0cacf5ab5ab3bf97c54c20b48ed9  NUM_50905.vbs

EXAMPLES OF QAKBOT EXE FILES (ALL 2,295,808 bytes):

- 07f428982f0ff41bbb792f037b7c3168772e73603c2ad3354a1d1c0980c63ed6  C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- 0e9828d862f7ce0bc287ed2ee548befaad6ffd4eecc6a753f137e68221b78518  C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- 4fa643894b181647d6181697730df99cbda1a82e28299920ecd1ab0fae2f679b  999999.png
- a37da79053a196bce0c98dbcec26585d09613210b4e06b5e2524971c1feb2ff4  999999.png