{"id":13532,"date":"2023-03-01T11:53:57","date_gmt":"2023-03-01T11:53:57","guid":{"rendered":"https:\/\/gridinsoft.com\/blogs\/?p=13532"},"modified":"2023-03-01T12:05:42","modified_gmt":"2023-03-01T12:05:42","slug":"new-qakbot-spreading-ways","status":"publish","type":"post","link":"https:\/\/gridinsoft.com\/blogs\/new-qakbot-spreading-ways\/","title":{"rendered":"Qakbot Malware Applies New Distribution Methods"},"content":{"rendered":"

Today there is an arms race between cybercriminals and antimalware manufacturers. While some release a fix for an existing threat, others must develop new loopholes. Recently, cybersecurity experts noticed that many malware families were using OneNote attachments to infect their victims. Since OneNote is considered a robust application<\/strong> that Microsoft has developed for easy note-taking, hackers couldn’t help but take advantage of it for their nefarious purposes. Next, we will look at some relatively new ways of spreading the known Qakbot banking Trojan.<\/p>\n

What is Qbot?<\/h2>\n

Before moving on to distribution methods, let’s recap QakBot. Qakbot Malware (QuakBot, or QBot) is a banking Trojan<\/a> designed to steal confidential information from Windows computers. For starters, it is worth mentioning that this type of malware is nothing new, and it appeared in 2007. Since then, it has undergone many changes, primarily aimed at bypassing security features<\/strong>. What has stayed the same, however, is the distribution method. For the most part, it’s email spam. However, after infecting one machine, QakBot can spread to other devices on the network.<\/p>\n

Furthermore, it has modular protection. Hence, the operator can fully customize it according to the objectives. For example, it can be network reconnaissance, keylogging, credential theft, botnet deployment, or ransomware<\/a>. In some cases, botnets under the rule of QakBot were delivering CobaltStrike beacons<\/a>.<\/p>\n

Distribution using OneNote Using Batch & PowerShell<\/h2>\n

The primary method of spreading Qakbot is through e-mail spamming<\/a>. Previously, a rogue email contained an MS Office file with a malicious macro hidden inside<\/a>. However, after Microsoft forcibly disabled the execution of any macros coming from the Internet<\/strong>, Qakbot started attaching the OneNote attachment. Usually, such an email contains something like “RE: DRCP Hire-Success Story…” and attachments are usually masked as legitimate files and named, for example, “Contracts – Copy.one”.<\/p>\n

A fake cloud attachment page opens<\/a> when the victim opens the OneNote attachment. This is done to get the victim to click on the BAT file<\/strong> (let’s call it Open.bat) that is embedded in Contracts – Copy.one. A PowerShell script is started as soon as the user runs this file, which in turn puts a CMD file with the conditional name “i.cmd” into the %temp%<\/strong> folder and runs it. This action is performed in a mode hidden from the user and not displaying any notifications<\/strong>. It then uses a PowerShell script to download a GIF file using the Invoke-Webrequest command. Although this file is saved as a JPG file in %programdata%<\/strong>, it has nothing to do with image files. Instead, it is an executable Qakbot DLL file that Rundll32.exe runs with the “Wind” parameter.<\/p>\n

\"QakBot<\/p>\n

Distribution Via OneNote Using Jscript (.jse) file<\/h2>\n

Similarly to the previous point, the initial stage of the infection process occurs via phishing emails, which also contain a OneNote attachment. However, unlike the last end, this attachment includes a JSE file<\/strong>. This file also contains a hidden Bat file, usually disguised as an “Open” button. After the user clicks this button, the batch file is launched. PowerShell script downloads the pseudo-gif file into a Temp system folder. This file is also different from what it looks like. It is an executable Qakbot DLL file which performs the routine unfolding process, same as in any other case scenario.<\/p>\n

\"QakBot<\/p>\n

Distribution using html Application (.hta) file<\/h2>\n

At the end of January 2023, Qakbot operators began experimenting with this new distribution method. It is identical to the previous way, except that instead of a JSE file, OneNote files contain an embedded HTML application (HTA file)<\/strong>. When the user clicks “open” on the OneNote page, it drops an embedded .hta file executed by mshta.exe in the background. The script in the HTA file uses the legitimate curl.exe application to load the Qakbot DLL file into the C:\\ProgramData<\/strong> folder and then run it. The Qakbot payload is injected into the Windows Auxiliary Technology Manager “AtBroker.exe” to hide its presence.<\/p>\n

Distribution using Windows Script (.wsf) Files<\/h2>\n

In this case, the phishing email contains an attachment in the form of a zip file with a random name, e.g., “Shared Document From Cloud 540318.zip”. There may be several files in the archive, including a wsf file. This file contains malicious JScript between digital certificates. Hence when a victim tries to open the .wsf file, it will run code to download the Qakbot DLL file. Usually, it is loaded in the C:\\ProgramData<\/strong> directory and run using “Rundll32.exe” with the parameter “Wind”.<\/p>\n

\"Qakbot<\/p>\n

Distribution using Google Ads<\/h2>\n

Since Microsoft, by default, blocks macros execution<\/a> in Office files downloaded from the Internet, attackers are finding ever more sophisticated ways to distribute malware. Thus lately, there has been a significant surge in malicious ads<\/a> that lead to a fake page of a legitimate program. Thus lately, there has been a significant surge in malicious advertising, which leads to a fake page of a legitimate program. However, instead of the legitimate program, the user receives malware. It may usually be a .exe or .msi file, which contains malware and many empty sections to avoid detection by anti-malware engine<\/strong>, as it overwhelms their file size limit.<\/p>\n

\"Fake
Fake LibreOffice ad that tries to mimic the original site’s URL<\/figcaption><\/figure>\n

How to avoid Qakbot Malware infection<\/h2>\n

To minimize the risk of Qakbot Malware infection, we recommend following cyber hygiene practices and the recommendations below:<\/p>\n