Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- 2020-04-22 (WEDNESDAY) - URLS/HASHES FOR QAKBOT (QBOT) SPX102, THE "/PUMP/" WAVE
- URLS FOR THE INITIAL ZIP ARCHIVES:
- - hxxp://157[.]245[.]69[.]233/wordpress/wp-content/themes/mapro/pump/Judgement_04212020_3804.zip
- - hxxp://157[.]245[.]69[.]233/wordpress/wp-content/themes/mapro/pump/Judgement_04212020_8178.zip
- - hxxp://akfoundationbd[.]xyz/wp/wp-content/themes/mapro/pump/Judgement_04212020_2373.zip
- - hxxp://atelierdegaia[.]fr/wp-content/themes/mapro/pump/Judgement_04212020_2760.zip
- - hxxp://baiseyapian[.]com/wp-content/themes/mapro/pump/6034/Judgement_04212020_6034.zip
- - hxxp://baiseyapian[.]com/wp-content/themes/mapro/pump/7514/Judgement_04212020_7514.zip
- - hxxp://beachview[.]co[.]za/wp-content/themes/mapro/pump/1636/Judgement_04212020_1636.zip
- - hxxp://beachview[.]co[.]za/wp-content/themes/mapro/pump/9056/Judgement_04212020_9056.zip
- - hxxp://chicare[.]aguademo[.]com/blog/wp-content/themes/mapro/pump/6338/Judgement_04212020_6338.zip
- - hxxp://cirkuscloudhosting[.]site/wp-content/themes/mapro/pump/1529/Judgement_04212020_1529.zip
- - hxxp://cirkuscloudhosting[.]site/wp-content/themes/mapro/pump/Judgement_04212020_2975.zip
- - hxxp://cirkuscloudhosting[.]site/wp-content/themes/mapro/pump/Judgement_04212020_4918.zip
- - hxxps://comedyticket[.]nl/wp-2Dcontent/themes/mapro/pump/2231/Judgement-04212020-5F2231.zip
- - hxxps://comedyticket[.]nl/wp-content/themes/mapro/pump/2988/Judgement_04212020_2988.zip
- - hxxps://comedyticket[.]nl/wp-content/themes/mapro/pump/5897/Judgement_04212020_5897.zip
- - hxxps://comedyticket[.]nl/wp-content/themes/mapro/pump/Judgement_04212020_1592.zip
- - hxxps:/comedyticket[.]nl/wp-content/themes/mapro/pump/5897/judgement_04212020_5897.zip
- - hxxp://garage[.]themebuffets[.]com/wp-content/themes/mapro/pump/0416/judgement_04212020_0416.zip
- - hxxp://longform[.]harker[.]org/wp-content/themes/mapro/pump/2495/Judgement_04212020_2495.zip
- - hxxp://longform[.]harker[.]org/wp-content/themes/mapro/pump/Judgement_04212020_3626.zip
- - hxxp://longform[.]harker[.]org/wp-content/themes/mapro/pump/Judgement_04212020_9352.zip
- - hxxp://pruebas2[.]reformasginesta[.]es/wp-content/themes/mapro/pump/Judgement_04212020_7512.zip
- - hxxp://sofil-photographe[.]com/wp-content/themes/mapro/pump/judgement_04212020_2594.zip
- - hxxp://swissblock[.]acorn[.]studio/wp-content/themes/mapro/pump/4345/Judgement_04212020_4345.zip
- - hxxp://tedxtest[.]devbyopeneyes[.]com/wp-content/themes/mapro/pump/7281/Judgement_04212020_7281.zip
- - hxxp://tedxtest[.]devbyopeneyes[.]com/wp-content/themes/mapro/pump/9916/Judgement_04212020_9916.zip
- - hxxp://tedxtest[.]devbyopeneyes[.]com/wp-content/themes/mapro/pump/Judgement_04212020_0183.zip
- URLS FOR THE QAKBOT EXE FILES:
- - NOTE: These were first noted by @lazyactivist192 on Twitter and posted at https://pastebin.com/L0g5fRgv (see the link for more info)
- - hxxp://hasumvina[.]nrglobal[.]top/wp-content/themes/mapro/pump/55555.png?uid=[base64 string]
- - hxxp://4mco[.]com[.]pk/wp/wp-content/themes/mapro/pump/55555.png?uid=[base64 string]
- - hxxp://cloud[.]wmsinfo[.]com[.]br/wordpress/wp-content/themes/mapro/pump/55555.png?uid=[base64 string]
- - hxxp://jeromenetpanel[.]ml/wp-content/themes/mapro/pump/55555.png?uid=[base64 string]
- - hxxp://cheshirecheetah[.]com/wp-content/themes/mapro/pump/55555.png?uid=[base64 string]
- EXAMPLES OF DOWNLOADED ZIP ARCHIVES:
- - 4b4460e7d427625a874f2a53f897b040bb454ae266b9ae40972033df225e1ef4 Judgement_04212020_2760.zip
- - a7a88ae558770b24d319e816c880cbc04fcd1468275583a06de4e33fe551af10 Judgement_04212020_3804.zip
- - 48a9cb2b82c3450f7621e4a6043184d933bb5464b3555916600ef32b185ccd23 Judgement_04212020_4918.zip
- - 1788d2f0645938522801f8292368510d7aecb500435f924f6ed85bbac7a17cd3 Judgement_04212020_9352.zip
- EXAMPLES OF EXTRACTED VBS FILES:
- - bfdcca2a12c2ff5a0ab1eb6ac97bd2d36a56da84bff50d6e1ca0cb7f61cb3f7b Judgement_04212020_0755.vbs
- - ff13874bc66e2a33a34f1101d26cd587bd97527bd6c1f4dfafefdcafa723b92d Judgement_04212020_4965.vbs
- - b257869e181f5738629664d8e3306140e779c88b09dbf6734ee9db6f315b746f Judgement_04212020_7334.vbs
- - db74909654809c9b2f29b03138b201e0ae70ad09758e2d517b5bd4a578e74d23 Judgement_04212020_9417.vbs
- EXAMPLES OF QAKBOT EXE FILES (ALL 2,372,096 BYTES):
- - 93fd86961cdee0ad33cdeb0cfd54f1de40147b2c8495ee8d23cdb14c775a8e04 C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- - a4d999070596e7c7591b52e55078ad11b8c9fa2e19d2713d3730cd738c6cb08e C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- - e391c8507178761ba50d98390881a235cba253ae59221c543812aa7b5c1fbc5a C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
- - e56ffc3eb0da05c10aa295ff906140b2b6802f4b446ccf5ed1d0f81f87f9d75b C:\Users\[username]\AppData\Local\Temp\PaintHelper.exe
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement