Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 2020-04-20 (MONDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX100, THE "/VARY/" WAVE
- URLS FOR THE INITIAL ZIP ARCHIVES:
- - hxxps://6686faka[.]com/wp-content/plugins/apikey/vary/12379.zip
- - hxxp://194.183.5[.]242/wp-content/uploads/2020/04/vary/72433.zip
- - hxxp://194.183.5[.]242/wp-content/uploads/2020/04/vary/835554765.zip
- - hxxps://51youqun[.]com/wp-content/plugins/apikey/vary/0292708/0292708.zip
- - hxxps://51youqun[.]com/wp-content/plugins/apikey/vary/12210055.zip
- - hxxps://51youqun[.]com/wp-content/plugins/apikey/vary/203113/203113.zip
- - hxxp://carnesribhaus[.]com.mx/wp-content/plugins/apikey/vary/3361569/3361569.zip
- - hxxp://carnesribhaus[.]com.mx/wp-content/plugins/apikey/vary/7908537.zip
- - hxxp://carnesribhaus[.]com.mx/wp-includes/vary/53201/53201.zip
- - hxxp://cimfl[.]com/wp-content/vary/100516985.zip
- - hxxp://cimfl[.]com/wp-content/vary/35442.zip
- - hxxps://fazautocare[.]com/wp-content/uploads/2020/04/vary/4160234.zip
- - hxxps://fazautocare[.]com/wp-content/uploads/2020/04/vary/66380.zip
- - hxxps://gnxpublishers[.]ca/wp-content/uploads/2020/04/vary/009518927/009518927.zip
- - hxxps://gnxpublishers[.]ca/wp-content/uploads/2020/04/vary/28506345.zip
- - hxxps://gnxpublishers[.]ca/wp-content/uploads/2020/04/vary/91393070/91393070.zip
- - hxxp://mehtapublicity[.]in/vary/469187054/469187054.zip
- - hxxps://member[.]irfansangjuara[.]com/wp-content/uploads/2020/04/vary/78075.zip
- - hxxp://ns-hd[.]co[.]jp/wp-content/uploads/2020/04/vary/63223.zip
- - hxxps://optica[.]co[.]in/vary/557650781.zip
- - hxxps://roirush[.]com/wp-content/vary/42868205/42868205.zip
- - hxxps://salvation24[.]com/vary/78130.zip
- - hxxps://salvation24[.]com/wp-admin/vary/324437/324437.zip
- - hxxps://salvation24[.]com/wp-admin/vary/26662446/26662446.zip
- - hxxps://sdeposito[.]com[.]br/wp-content/uploads/2020/04/vary/078178.zip
- - hxxps://smartfield[.]co[.]ke/wp-content/vary/619491/619491.zip
- - hxxp://test[.]wax[.]duzzling[.]com[.]tw/vary/62901.zip
- - hxxps://villette45[.]com/wp-content/uploads/2020/04/vary/400898538/400898538.zip
- URLS FOR THE QAKBOT EXE FILES:
- - NOTE: These were first noted by @lazyactivist192 on Twitter and posted at https://pastebin.com/kRKhdLfM (see the link for more info)
- - hxxp://tianmarket[.]shop/wp-content/uploads/2020/04/vary/111111[.]png?uid=[base64 string]
- - hxxp://textilesld[.]cluster020[.]hosting[.]ovh[.]net/wp-content/vary/111111[.]png?uid=[base64 string]
- - hxxp://phuhaihoang[.]vn/wp-content/uploads/2020/04/vary/111111[.]png?uid=[base64 string]
- - hxxp://thecorporatetailors[.]com[.]au/wp-includes/vary/111111[.]png?uid=[base64 string]
- - hxxp://b[.]adventh[.]org/2020/02/0218[.]png?uid=[base64 string]
- EXAMPLES OF DOWNLOADED ZIP ARCHIVES:
- - 03d707199f7751980976a94de5f920dca0104493b2c8f340077678c294181960 0292708.zip
- - 3ab7c35adbb569af22c591360eae79c319b8b3a385179ccf6af3fa981a0a04d1 7908537.zip
- - 4d67a790559a00ef8ef1673afc1e6750adc8ff1c3777957407681d1562835f4d 12379.zip
- - 80ee8ddf2a3f3b4d9226e8972c10c99e9402d2118cce2f6c5337367e6cedb664 324437.zip
- - a74f2bacc4e83cff2953d158281cd5184f1c657af7418adde2edc35d040054fb 835554765.zip
- EXAMPLES OF EXTRACTED VBS FILES:
- - 19fbc6fc6981342d8dbc24b39d431a8aae6d1df4c48703889bdd5a7c4b5d3e5a NUM_91391.vbs
- - 6dcf9decf31f360f42a421d9bcdfd0f0d41a17b7adb172c51b34f7f1663c816c NUM_65462.vbs
- - 6fa1f8ac0aa792ad5bf8b513a95fa4ad23407bdf84f69298689c4edc989e09f9 NUM_93575.vbs
- - a6e51333d70fa06a2482ad1551cb3789e0be96b8858838c1fa2c43c4d3f22fde NUM_35452.vbs
- - fba468926e82800ef6686958e698013442d6ffddcacb9c049af69b3b259137e2 NUM_61521.vbs
- EXAMPLES OF QAKBOT EXE FILES (ALL 2,302,976 bytes):
- - 10557f257f69bebc6fd493321171963bdf469f40bffafdf2e3c538139b3b7df8 C:\Users\[useranme]\AppData\Local\Temp\PaintHelper.exe
- - 3b3f3a6020cb54317beffb438574f521cad87f80c7a8ec43a3cbc02bec3dafa4 C:\Users\[useranme]\AppData\Local\Temp\PaintHelper.exe
- - 7e803243bc9dd22db1e967903af48b2baf70b68ccf5a5fe40e751d766580cf75 C:\Users\[useranme]\AppData\Local\Temp\PaintHelper.exe
- - cfa4d49151458a745e84e8415377ba082221499784c56b67e671011372c73827 C:\Users\[useranme]\AppData\Local\Temp\PaintHelper.exe
- - d447bf5ad39d971b7364a06b546a996bf7cc4857f7b9ccecf93303d30aaecdf6 C:\Users\[useranme]\AppData\Local\Temp\PaintHelper.exe
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement