silversurfer

Level 52
Verified
Trusted
Content Creator
Malware Hunter
An active malware campaign primarily targeting U.S. corporations with a new polymorphic variant of the Qbot banking trojan has been compromising thousands of victims around the world, researchers have reported.

The worm-like malware, whose original version is roughly a decade old, allows attackers to collect browsing activity and steal bank account credentials and other financial information. This is accomplished through a combination through a combination of techniques, including keylogging, credential and cookie exfiltration, and hooking.

Despite the campaign’s focus on the U.S., victims have been observed as far as Europe, Asia and South America, according to a blog post today from Varonis.

At last report, the company found 2,726 unique victims IP address, but the true number is most likely considerably larger. The U.S. is home to 1,730 of these victims, with the U.K., Germany and South Africa the next most affected nations.

Also known as Qakbot, “Qbot employs anti-analysis techniques, frequently evades detection, and uses new infection vectors to stay ahead of defenders,” warns blog post authors and researchers Dolev Taler and Eric Saraga. The variant, they explain, constantly modifies its tactics, creating files and folders with random names, frequently switching command-and-control servers and even changing the malware loader where there is an active internet connection.

Varonis believes the new Qbot is likely spreading via a phishing operation. This theory that is supported by the discovery of a zip file carrying a malicious VBS file with a .doc.vbs extension.

This VBS file determines the OS version of the victim’s machine and then looks for signs of anti-virus software from various major security vendors. And in a new behavior, the malware uses the BOTSAdmin command-line tool to produce a downloader component that ultimately introduces the main malicious payload.
 

shmu26

Level 83
Verified
Trusted
Content Creator
"And in a new behavior, the malware uses the BOTSAdmin command-line tool to produce a downloader component that ultimately introduces the main malicious payload."

It's a typo. They mean Bitsadmin.
 

upnorth

Level 34
Verified
Trusted
Content Creator
"And in a new behavior, the malware uses the BOTSAdmin command-line tool to produce a downloader component that ultimately introduces the main malicious payload."

It's a typo. They mean Bitsadmin.
Good catch! The main source got it right.

 

Andy Ful

Level 48
Verified
Trusted
Content Creator
Standard delivery path:
phishing webpage or email attachment ---> ZIP file with VBS dropper or MS Office document with macro ---> VBS dropper (uses bitsadmin.exe, and executes the payload).
As usual, blocking scripts/macros will prevent the infection. No need to use the firewall rules (not efficient with bitsadmin.exe) or blocking the execution of bitsadmin.exe, or fighting the payload(y).
 
Last edited: