silversurfer

Level 78
Verified
Helper
Top poster
Content Creator
Malware Hunter
Well-known
Aug 17, 2014
6,737
An active malware campaign primarily targeting U.S. corporations with a new polymorphic variant of the Qbot banking trojan has been compromising thousands of victims around the world, researchers have reported.

The worm-like malware, whose original version is roughly a decade old, allows attackers to collect browsing activity and steal bank account credentials and other financial information. This is accomplished through a combination through a combination of techniques, including keylogging, credential and cookie exfiltration, and hooking.

Despite the campaign’s focus on the U.S., victims have been observed as far as Europe, Asia and South America, according to a blog post today from Varonis.

At last report, the company found 2,726 unique victims IP address, but the true number is most likely considerably larger. The U.S. is home to 1,730 of these victims, with the U.K., Germany and South Africa the next most affected nations.

Also known as Qakbot, “Qbot employs anti-analysis techniques, frequently evades detection, and uses new infection vectors to stay ahead of defenders,” warns blog post authors and researchers Dolev Taler and Eric Saraga. The variant, they explain, constantly modifies its tactics, creating files and folders with random names, frequently switching command-and-control servers and even changing the malware loader where there is an active internet connection.

Varonis believes the new Qbot is likely spreading via a phishing operation. This theory that is supported by the discovery of a zip file carrying a malicious VBS file with a .doc.vbs extension.

This VBS file determines the OS version of the victim’s machine and then looks for signs of anti-virus software from various major security vendors. And in a new behavior, the malware uses the BOTSAdmin command-line tool to produce a downloader component that ultimately introduces the main malicious payload.
 

shmu26

Level 85
Verified
Helper
Top poster
Content Creator
Well-known
Jul 3, 2015
8,120
"And in a new behavior, the malware uses the BOTSAdmin command-line tool to produce a downloader component that ultimately introduces the main malicious payload."

It's a typo. They mean Bitsadmin.
 

JM Safe

Level 39
Verified
Top poster
Apr 12, 2015
2,868
Usually this type of malware can use low-level hooks (such as WH_KEYBOARD_LL) to perform keylogging of all keystrokes fastly and deeply.

"And in a new behavior, the malware uses the BOTSAdmin command-line tool to produce a downloader component that ultimately introduces the main malicious payload."

It's a typo. They mean Bitsadmin.
+1.
 

upnorth

Moderator
Verified
Staff member
Malware Hunter
Well-known
Jul 27, 2015
4,565
"And in a new behavior, the malware uses the BOTSAdmin command-line tool to produce a downloader component that ultimately introduces the main malicious payload."

It's a typo. They mean Bitsadmin.
Good catch! The main source got it right.

 

Andy Ful

Level 75
Verified
Helper
Top poster
Developer
Well-known
Dec 23, 2014
6,429
Standard delivery path:
phishing webpage or email attachment ---> ZIP file with VBS dropper or MS Office document with macro ---> VBS dropper (uses bitsadmin.exe, and executes the payload).
As usual, blocking scripts/macros will prevent the infection. No need to use the firewall rules (not efficient with bitsadmin.exe) or blocking the execution of bitsadmin.exe, or fighting the payload(y).
 
Last edited:
Top