Analysis of Qakbot Malware

QakBot, aka QBot, QuakBot or Pinkslipbot, is a banking trojan malware that has existed for over a decade. The main purpose of Qbot is to steal banking credentials and other financial information (e.g., login credentials, passwords etc), while being able to deploy additional malware, log a user’s keystrokes, and create a backdoor to the compromised machines.

Some highlights of Qbot (Qakbot) malware are as follows,

The malware operates with a modular framework to inject DLL (payload) in to an existing Windows process,

Deploy any ransomware such as Blackbyte, Blackbasta (Conti Affiliates) or, Royal Ransomware on will,

Persist and survive reboots with Cobalt Strike payloads, and/or scheduled tasks on Windows,

Last but not least, through the cookie grabber and password stealer – it can steal passwords from popular browsers.

Did You Know? Malware authors also love continuous development lifecycles such as devops! Anecdotal evidence suggests around the first half of 2018, Qbot’s major version was 324! The most recent version of Qbot observed by LMNTRIX CDC was 401 to 403 in Jan 2021.

Infection Chain:

The initial attack vector may vary depending on the targets as we all know, the threat actors perform basic reconnaissance after initial access is established to decide their next steps. We have observed 3 variations of Qbot (Qakbot) being delivered namely,

Malspam -> Zip -> Javascript -> Qbot Infection

Malspam -> Zip -> VBS -> Qbot Infection

Malspam -> Word DOC (Macro) -> Qbot Infection

Qbot was previously distributed by Emotet, as observed by LMNTRIX CDC. Generally, QBot infects the victims by initial infection vector of malspam e-mails. This kind of e-mail contains Microsoft Office documents (Excel) or sometimes comes with password-protected archives format attachments. Usually, the document contains macros, and the victims are tricked to enable the macro content leading to the malicious actions. (e.g., an invoice or shipping attachment).

Sample Information:

Why are malware authors using this file format?
XLSB is an Excel Binary Workbook file. They store information in binary format instead of XML like with most other Excel files (like XLSX). They can be read from and written much faster, making them extremely useful for very large spreadsheets. Also, the file sizes are smaller in XLSB, when compared with XLSX. Mainly .XLSB files have macros embedded in it, where they can store potentially malicious code.

Technical Analysis of Qbot XLSB:

Snap 1: Enabled Content

Snap 2: Hidden Sheets

Excel worksheets are in hidden mode, and we need to unhide to see the contents embedding in the Sheets. Usually, it will contain URLs, Malicious/blacklisted IPs, and payload file paths etc., So far, QBot hasn’t changed the infection flow for macro styled attacks.

File Structure of the .xlsb:

Macrosheets:

In fact, for huge Excel files used for accounting or statistical purposes, the XLSB format is very beneficial considering the amount of memory used by an XLSX file. With respect to this, the malware authors enter their malicious code directly into the cell formulas, which are hidden.

• By changing the font color.
  Ex: [Sheet White color & Font white color].
• By making hidden sheets with empty data but usually containing malicious contents.

Hidden Content:

Payload files:

Once the user enables the content, then the payload files will execute on the victim’s computer.

Ready, Set, Qbot: Following an infection, Qbot acts rapidly to accomplish privilege escalation, and 10 minutes later, it can steal your e-mail, passwords, banking credentials and start a full-fledged reconnaissance scan in 30 minutes or less.

Using Regsvr32, payload files will be present in the C:\\ Drive:

Payload files (in DLL format) – Dropped in the C Drive:

A brief description of anti-analysis techniques used by Qbot,

Instance 1: Encrypted Strings.

The majority of the embedded strings are encrypted and decrypted on demand by Qbot. The decryption routine takes one argument, the string index, and XOR function is used with an array until it encounters a null byte. Decrypting the strings can be aided by a framework such as IDAPython.

Instance 2: Simply put, it can stop functioning normally, when it’s being analysed.

Some of the interesting, anti VM features include,

(1) Qbot forcing an exception to exit when debugger is present,

(2) Blacklisting malware analysis tools such as fiddler, process hacker, ollydbg, windbg, wireshark, tcpview, resource hacker, and around 37 analysis tools have been blacklisted, by the malware authors.

(3) The “/C” parameter instructs QBot to spawn a new process thread, which aids in performing anti-analysis checks. Qbot executes assembly code with the keyword “VMXh,” which causes an exception when run in a Virtual Machine. If the exception handler is successful, it returns exit code 1, otherwise it returns 0. The parent process examines the spawned process’s exit code. If the exit code is 0, QBot continues to function normally; if the exit code is not zero (0), QBot is being analysed and thus ceases to function.

Initial IOC (Indicator of Compromise – HTTP)

Once a victim is infected, the following process/functions are performed by Qakbot;

• Collecting information about the compromised host.
• Creating scheduled tasks (privilege escalation and persistence).
• Credentials harvesting & dumping (.exe access).
• Password stealing (from browser history and cookies).
• Targeting web banking links (web injects).
• Password brute forcing.
• Registry manipulation (persistence) to survive reboots.
• Replicating/relaunching it’s own copies through multiple instances using regsvr32.
• Process injection to conceal malicious actions.

Conclusion:

When the victim opens the latest variant’s HTML file, the javascript code (shellcode) is executed. The ZIP file includes a Windows shortcut file that looks like a text file. The most recent Qbot infections result in the execution of a loader program. As per our observations of Qbot’s recent operations, adversaries behind the distribution of Qbot have taken new approaches to take their evasion capabilities to the next level by imitating common formats with ZIP file extensions to lure targets with malicious attachments that install Qbot.

Not to forget, Qbot is also polymorphic in nature, which means it can change even after it has been installed on an endpoint. LMNTRIX CDC has observed that, Qbot has been recently used by Blackbasta, Blackbyte and Royal ransomware groups in 2023 for launching multi stage attacks after initial infection.

The threat actors behind the Qbot banking trojan keep constantly changing files, infection vectors and the dropper (payloads) in the newer versions of Qbot is constantly cycling through command-and-control servers. We consider Qbot as a highly dangerous malware, because of the combination of anti-analysis, anti-vm and polymorphic capabilities.

Indicators of Compromises [IOC] to detect Qakbot/Qbot;

MITRE ATT&CK Tactics & Techniques used by QBot:

This lab article is a living blog post… We will update this blog post, as appropriate.