Qbot needs only 30 minutes to steal your credentials, emails

[Gandalf_The_Grey]

The widespread malware known as Qbot (aka Qakbot or QuakBot) has recently returned to light-speed attacks, and according to analysts, it only takes around 30 minutes to steal sensitive data after the initial infection.

According to a new report by DFIR, Qbot was performing these quick data-snatching strikes back in October 2021, and it now appears that the threat actors behind it have returned to similar tactics.

More specifically, the analysts report that it takes half an hour for the adversaries to steal browser data and emails from Outlook and 50 minutes before they jump to an adjacent workstation.

The initial access is typically achieved via an Excel (XLS) document that uses a macro to drop the DLL loader on the target machine.

This payload then executes to create a scheduled task via the msra.exe process and elevates itself to system privileges.

Additionally, the malware adds the Qbot DLL to Microsoft Defender's exclusion list, so it won't be detected when injection into msra.exe happens.

However, no matter how a Qbot infection unfolds precisely, it is essential to keep in mind that almost all begin with an email, so this is the main access point that organizations need to strengthen.

Today's announcement by Microsoft that they will be blocking macros in downloaded documents by default by removing the 'Enable Content' and 'Enable Editing' buttons will go a long way to protecting users from Qbot phishing attacks.

 

[Andy Ful]

Qbot mostly used one of three email methods: malicious links, malicious attachments, or more recently, embedded images.

In the recent attacks via weaponized Excel documents, the attack used a VBA macro to create a new macrosheet and write Excel 4.0 formulas into its cells. So, blocking the VBA support in MS Office could prevent this attack even if the Excel 4.0 macros were enabled.

In the year 2021, the attackers started using non-active URLs to avoid detecting malware via detonating URLs in the sandbox. So, the user had to write the URL manually in the web browser to continue the infection. In the recent attacks, the malicious URL was displayed as an image embedded in the document.

See also:

A closer look at Qakbot’s latest building blocks (and how to knock them down) - Microsoft Security Blog

Multiple Qakbot campaigns that are active at any given time prove that the decade-old malware continues to be many attackers’ tool of choice, a customizable chameleon that adapts to suit the needs of the multiple threat actor groups that utilize it. Since emerging in 2007 as a banking Trojan...

www.microsoft.com