Shifty new variant of Qbot banking trojan spreads

[silversurfer]

Content source

https://www.scmagazine.com/home/security-news/shifty-new-variant-of-qbot-banking-trojan-spreads/

An active malware campaign primarily targeting U.S. corporations with a new polymorphic variant of the Qbot banking trojan has been compromising thousands of victims around the world, researchers have reported.

The worm-like malware, whose original version is roughly a decade old, allows attackers to collect browsing activity and steal bank account credentials and other financial information. This is accomplished through a combination through a combination of techniques, including keylogging, credential and cookie exfiltration, and hooking.

Despite the campaign’s focus on the U.S., victims have been observed as far as Europe, Asia and South America, according to a blog post today from Varonis.

At last report, the company found 2,726 unique victims IP address, but the true number is most likely considerably larger. The U.S. is home to 1,730 of these victims, with the U.K., Germany and South Africa the next most affected nations.

Also known as Qakbot, “Qbot employs anti-analysis techniques, frequently evades detection, and uses new infection vectors to stay ahead of defenders,” warns blog post authors and researchers Dolev Taler and Eric Saraga. The variant, they explain, constantly modifies its tactics, creating files and folders with random names, frequently switching command-and-control servers and even changing the malware loader where there is an active internet connection.

Varonis believes the new Qbot is likely spreading via a phishing operation. This theory that is supported by the discovery of a zip file carrying a malicious VBS file with a .doc.vbs extension.

This VBS file determines the OS version of the victim’s machine and then looks for signs of anti-virus software from various major security vendors. And in a new behavior, the malware uses the BOTSAdmin command-line tool to produce a downloader component that ultimately introduces the main malicious payload.

 

[shmu26]

"And in a new behavior, the malware uses the BOTSAdmin command-line tool to produce a downloader component that ultimately introduces the main malicious payload."

It's a typo. They mean Bitsadmin.

 

[JM Safe]

Usually this type of malware can use low-level hooks (such as WH_KEYBOARD_LL) to perform keylogging of all keystrokes fastly and deeply.

"And in a new behavior, the malware uses the BOTSAdmin command-line tool to produce a downloader component that ultimately introduces the main malicious payload."

It's a typo. They mean Bitsadmin.

+1.

 

[upnorth]

"And in a new behavior, the malware uses the BOTSAdmin command-line tool to produce a downloader component that ultimately introduces the main malicious payload."

It's a typo. They mean Bitsadmin.

Good catch! The main source got it right.

Varonis Exposes Global Cyber Campaign: C2 Server Actively Compromising Thousands of Victims

The Varonis Security Research team discovered a global cyber attack campaign leveraging a new strain of the Qbot banking malware. The campaign is actively targeting U.S. corporations but has hit networks...

blogvaronis2.wpengine.com

 

[Andy Ful]

Standard delivery path:
phishing webpage or email attachment ---> ZIP file with VBS dropper or MS Office document with macro ---> VBS dropper (uses bitsadmin.exe, and executes the payload).
As usual, blocking scripts/macros will prevent the infection. No need to use the firewall rules (not efficient with bitsadmin.exe) or blocking the execution of bitsadmin.exe, or fighting the payload.