{"id":21797,"date":"2023-04-24T08:59:26","date_gmt":"2023-04-24T16:59:26","guid":{"rendered":"https:\/\/www.palada.net\/index.php\/2023\/04\/24\/news-15528\/"},"modified":"2023-04-24T08:59:26","modified_gmt":"2023-04-24T16:59:26","slug":"news-15528","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/04\/24\/news-15528\/","title":{"rendered":"QBot changes tactic, remains a menace to business networks"},"content":{"rendered":"

QBot, an infostealer-turned-dropper that aids criminal gangs in their malicious campaigns, is now being distributed as part of a phishing campaign using PDFs and Windows Script Files (WSF), according to recent discoveries by malware hunter Proxylife (@pr0xylife<\/a>) and the Cryptolaemus group (@Cryptolaemus1<\/a>).<\/p>\n

The last time QBot (aka QakBot) had its modus operandi changed was in November. Campaign operators adopted<\/a> tactics from Magniber’s playbook to successfully exploit a Mark of the Web (MotW) zero-day flaw to run a JavaScript (JS) that executed QBot.<\/p>\n

The latest QBot phishing campaign is illustrated simply in the diagram below:<\/p>\n

\"\"The QBot campaign illustrated (Source: Jerome Segura | Malwarebytes Labs)<\/p>\n

The attack starts with a reply-chain phishing email, when threat actors reply to a chain of emails with a malicious link or attachment. BleepingComputer has noted<\/a> that these phishing emails use a variety of languages. This means the language barrier is absent in such an attack, so any business from any part of the world could be affected.<\/p>\n

\"\"
A sample reply-chain phishing email in French, carrying a PDF attachment disguised as a cancellation letter. (Source: BleepingComputer)<\/p>\n

Once someone in the email chain opens the attached PDF, they see a message saying, “This document contains protected files, to display them, click on the ‘open’ button.” Clicking the button downloads a ZIP file containing the WSF script.<\/p>\n

\"\"<\/p>\n

The heavily obfuscated script contains a mix of JS and VBScript code that, when run, triggers a PowerShell that then downloads the QBot DLL from a list of hardcoded URLs. This script tries each URL until a file is downloaded to the Windows Temp folder (%TEMP%) and executed.<\/p>\n

Once QBot runs, it issues a PING command to check for an internet connection. It then injects itself into wermgr.exe<\/em>, a legitimate Windows Error Manager program, to run quietly in the background.<\/p>\n

Because QBot is said to be used by operators of ransomware-as-a-service (RaaS) offerings, its presence in company systems could be disastrous. Therefore, any organization must take its QBot-infected systems offline as soon as possible and thoroughly scan and review network logs for unusual behavior.<\/p>\n

The DFIR Report in February 2022 showed<\/a> QBot collecting data from a compromised system 30 minutes after infecting it. Within an hour, QBot can be spread to adjacent systems.<\/p>\n

Malwarebytes detects the malicious DLL (QBot).<\/p>\n

\"\"<\/p>\n

\n

Malwarebytes removes all remnants of ransomware and prevents you from getting reinfected. Want to learn more about how we can help protect your business? Get a free trial below.<\/p>\n

TRY NOW<\/a><\/p>\n

https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"\n\n
\n

Categories: News<\/a><\/p>\n

Tags: QBot<\/p>\n

Tags: Trojan dropper<\/p>\n

QBot has resurfaced with a new tactic involving a reply-chain phishing email, a fake PDF, and the likely promise of a ransomware infection.<\/p>\n\n\n
\n

(Read more…<\/a>)<\/b><\/p>\n<\/td>\n<\/tr>\n<\/table>\n<\/td>\n<\/tr>\n<\/table>\n

The post QBot changes tactic, remains a menace to business networks<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[10488,10378],"tags":[32,10740,28678],"class_list":["post-21797","post","type-post","status-publish","format-standard","hentry","category-malwarebytes","category-security","tag-news","tag-qbot","tag-trojan-dropper"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/21797","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=21797"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/21797\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=21797"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=21797"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=21797"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}