Qbot, also known as (QakBot, Pinkslipbot) is a continually evolving banking trojan seen in the wild as early as 2009. Distributed through phishing email campaigns, Qbot is dropped on the target machine after the user clicks on a link in the email leading to the dropper packed in a ZIP archive. When targeting networks, Qbot is able to brute force its way through network accounts, allowing lateral movement and infecting hosts en masse. Like other banking trojans, Qbot is capable of keylogging and harvesting credential information from browsers; more specific to Qbot is its hooking capability. The primary payload of Qbot injects itself onto other system processes, searching for strings related to financial information, then exfiltrating the data to the operator's C2 (command and control) server.
These field notes document the rapid dissection of a QBot distribution campaign via PDF files containing a password and link to an encrypted ZIP, containing an ISO, which in-turn contains a Windows shortcut file (LNK) that pivots to an embedded DLL via rundll32.
11024b63fe5418543d822555c88f30df98d7b489a42841479248ef450f97de9f
2133037fd10a34134963fa376b64237afde6284e7574cc32884b09f655ef97e9
2abe4e8b97f182c0d60c878cab9c0b7280a8f0ed41fe2a54c2c270874d25a18f
2e7e4b51ebd5e632ea1e164b214269b8de635c13a50a10b3d436901e0ab8685e
311a592ffb20c178c528cf5f08c86364f3b4981a2e3af4e6dc025533227affd3
3490126534de5f790033b27af02690613bab1ccf3a0dc41e64f586399dada814
34d82f10f403ebcd3b83948c4144e28807266010e9b40772cff6d19115b50c66
375c900401c76595e1f2acbaee23dd60e94dba982d17bec11448d53c31a480e3
3ac0b1784bd23b0d06a2d3b7b976fb1777377009156f0584a61d7b22630b16b5
44a9b860d95033846f66289f204fbf3d4bed238a796deed9402de06fd7207eea
4f262169bc049f03976b3ac89b6cf18f21aebe7cb21f6ee98ebc37a08fed7797
5117299b80920c75c3e7792359065dd8f8977cd9da556208be0b7ee358f4290d
512351e6f52e1fe1910d566cf38289a18f79d3366e7b236c8ae3378c8d6ecd96
525f6ef2abe854a1ea47c1c88688111227075e8c590791e8306789af120ef974
5b08af5892624cb8877a50981972c759ad876493a813e990648084c1403c4ecc
5d293002160a10b8ede4de7192c49785184c2426eb9b4d6a01fd173cc3f1e4cb
5ea837cc092e31d95349019f320ad4e88c245b571a57bc1db76a07c0668b8509
60cbe57d14f081bc5f4349ea4a4eeac78e928cd00be481a993e1757c62b5bdc5
63bd92f2995150b00d9dd8c5d20ecf1ed1c6c7336898b2d7791f6ec9014538ec
6acd61b1f731ce4979f2a792b25f9e0f5f60b3fbd26e7e0469838d1088d43a3a
6d30d7164ef759d49d5ddb5f297117443da40ab1894f62f675bfe8cd78b8827b
791d4714c0659dc2c8e5edf0b1c932b36895bb905c91f920ac3b1daeb760e784
7e1034fd8d92666e8656a5266ea201440ee0b8716bdead70d77bbcce5346e987
80a17d1e4cd079beff142d9cc468295459ed316b2d1678e136ede171d2adbbfa
81e1942b78118894aaada1cc8df6e58fef4f801473aa69e96febac11fb8d6d0e
86ff1e4f972a646aab33ab07bf5d0e915d3b948c222688d0654a74b0ac4a747e
8a55a5032dc57a60d01a74d7b105e7372f671951b1e1681066bb05f6da247d95
8ce70b3365de9039bf0dc4bacb404105bc1b276604ef122280e1778b96180577
95d5f0ed5f30a116fb4cad1bd15b9cb63f007dfbf3695af8842e003b1fcb2f1a
95f29501d31038be6509e7fe96e2adee79bd86185d9fefb0c17502dc7ed51acd
9cc2e65b112c3f0a4d574bd4594aa2880c292714436e5645476b3ce6ed673ea0
9d1da77e0126100eebdde8064a88520974d8f7ae280c7ce502b2299bc9ecae44
bec02f0e6e4be67129d1eb1530b99e4f5b35c076fd0566a2fc200281c9b22058
c5b7e82785ea34421f5b830e48b6cfc561be3594bd737254aaaa127a220b8891
d0ab89a1c9e7ebd81dc57ec1160af5ed281aa76012227d473c4e6516eb74ce0c
d2ef7d5fe11dea50fa8df04b1737866e24fa05cfd02865620f18e781f8f2d01a
e32e884a326e7d90f8443f0f1e10a0bd09c44cd4d397cc6f0d394a2b9f02eb6e
e7a29c1cbfb26e40511c81a25b087d7c4395bcca027b5576dfc0bda327bdeb7d
ea83419d8de868fe1aa25f4645fd143d9b2413b316105d44b56623312bbb54ce
f297278977335292e3bde68be77a9e6d8a62db339eaba1c8507476f5087066ae
AV detections range for the PDF lures, from a 1 to 9 vendors, the distribution of detection count is as follows (where Key is equal to the number of detections):
Key|Ct (Pct) Histogram
1|10 (25.00%) ------------------------------------------------------------------
5| 8 (20.00%) -----------------------------------------------------
3| 8 (20.00%) -----------------------------------------------------
4| 7 (17.50%) ----------------------------------------------
6| 3 (7.50%) --------------------
9| 2 (5.00%) --------------
7| 1 (2.50%) -------
2| 1 (2.50%) -------
One example:
Collection of URLs found in above PDF sample hashes. Many of these are active as of this time of writing.
hxxp://206.53.48.240/DocumentsFolder_XXXXXX_12202022[.]zip
hxxp://43.230.161.159/DocumentsFolder_XXXXXX_12202022[.]zip
hxxp://49.50.84.61/DocumentsFolder_XXXXXX_12202022[.]zip
hxxp://49.50.84.61/DocumentsFolder_XXXXXX_12202022[.]zip
hxxp://51.161.41.210/DocumentsFolder_XXXXXX_12202022[.]zip
hxxp://51.68.201.10/DocumentsFolder_XXXXXX_12202022[.]zip
hxxp://acg-sa.com/cln/Cancellation_378377_Dec23[.]zip
hxxp://arlation.com/way/Cancellation_427778_Dec23[.]zip
hxxp://arlation.com/way/Cancellation_427778_Dec23[.]zip
hxxp://banfflocal.ca/way/Cancellation_544102_Dec23[.]zip
hxxp://banglapdf.net/way/Cancellation_181535_Dec23[.]zip
hxxp://beachamptonmotors.co.uk/cln/Cancellation_462262_Dec23[.]zip
hxxp://bionicsremedies.in/blog/Attn_XXXXXX_12222022[.]zip
hxxp://cdasspaints.com/blog/Cancellation_508825_Dec23[.]zip
hxxp://datahawkanalytics.com/blog/Cancellation_302264_Dec23[.]zip
hxxp://demosite.dasdigital.com.au/blog/Attn_XXXXXX_12222022[.]zip
hxxp://fdjuvenil.dev.radar.cl/cln/Cancellation_283112_Dec23[.]zip
hxxp://jajabor.clothing/way/Cancellation_705412_Dec23[.]zip
hxxp://locksmithtopor24hours.co.uk/blog/Attn_XXXXXX_12222022[.]zip
hxxp://marc.pe/blog/Attn_XXXXXX_12222022[.]zip
hxxp://mobilekhujun.com/blog/Attn_XXXXXX_12222022[.]zip
hxxp://mycellmobile.com/blog/Attn_XXXXXX_12222022[.]zip
hxxp://rxp.com/blog/Attn_XXXXXX_12222022[.]zip
hxxp://shipping.925cz.com/cln/Cancellation_212051_Dec23[.]zip
hxxp://slempitdesa.gresikkab.go.id/blog/Cancellation_528880_Dec23[.]zip
hxxp://squarebx.com/way/Cancellation_275869_Dec23[.]zip
hxxp://tiqany.net/blog/Attn_XXXXXX_12222022[.]zip
hxxp://uf-pz.net/blog/Attn_XXXXXX_12222022[.]zip
hxxp://wharfehealthcare.org/way/Cancellation_241589_Dec23[.]zip
hxxp://woohomez.com/way/Cancellation_753378_Dec23[.]zip
Because of the password protection, we can expect detection rates to be low here, and they are:
