The Evolution of Qakbot: How Cato Networks Adapts to the Latest Threats 

Listen to post: Getting your Trinity Audio player ready...

The world of cybersecurity is a never-ending battle, with malicious actors constantly devising new ways to exploit vulnerabilities and infiltrate networks. One such threat, causing headaches for security teams for over a decade, is the Qakbot Trojan, also known as Qbot. Qakbot has been used in malicious campaigns since 2007, and despite many attempts to stamp it out, continues to evolve and adapt in an attempt to evade detection.

Recently, the Cato Networks Threat Research team analyzed several new variants of Qakbot that exhibited advanced capabilities and evasive techniques to avoid detection and quickly built and deployed protection for the additional changes into the Cato Networks IPS. 

In this analysis, Cato Networks Research Team exposes the tactics, techniques, and procedures (TTPs) of the latest Qakbot variant and explores its potential impact on enterprises and organizations if left alone.

Why Now?

During the COVID-19 pandemic, an eruption of cyberattacks occurred, including significant growth of attacks involving ransomware. As part of this surge, Qakbot’s threat actor adapted and paired with other adversaries to carry out ferocious multi-stage attacks with significant consequences.

Qakbot is sophisticated info-stealing malware, notorious as a banking trojan, and is often used to steal financial information and conduct fraudulent financial transactions. Pursuing even larger gains, in the last few years, Qakbot targets have shifted from retail users to businesses and organizations.

As recent versions of Qakbot emerge, they present new infection techniques to both avoid detection and maintain persistence on the infected systems. Qakbot’s latest design updates, and additionally complex multi-stage infection processes, enable it to evade detection using most traditional security software detection techniques, and pose a significant and ongoing threat to unprotected businesses and organizations.

How Do the Latest Versions of Qakbot Work?

The first stage of the Qakbot infection process begins when a user clicks on a link inside a malicious email attachment. In the latest Qakbot versions, the malicious file attachments are typically ZIP, OneNote or WSF files (a file type used by the Microsoft Windows Script Host.). Zip, OneNote and WSF files are commonly used by malicious actors as they make it easier to evade the Mark of the Web (MOTW). MOTW is a security mechanism implemented by Microsoft to detect and block files with macros (such as Excel files) that were downloaded from the internet and may be compromised. By using file types that do not receive MOTW, Qakbot attachments are more likely to evade detection and blocking.

When the user opens the WSF or OneNote file and clicks the embedded link, Qakbot covertly launches a series of commands, allowing the malware to infect the system and take additional measures to evade detection.

Cato Networks SASE Threat Research Report H2/2022 | Download the Report

Malicious files are cloaked as innocuous files by abusing Living Off the Land Binaries (LOLBins) and by imitating commonly used file types, such as Adobe Cloud files, to stay hidden. LOLBins are legitimate binaries or executables found in the Windows operating system that are also used by attackers to carry out malicious activities. These binaries are typically present on most Windows machines and are legitimately used for system maintenance and administration tasks but can easily be abused to execute malicious code or achieve persistence on compromised systems. Attackers commonly make use of LOLBins because they are present on most Windows systems and are typically on the allow list of common security software, making them more difficult to detect and block. Examples of common LOLBins include cmd.exe, powershell.exe, rundll32.exe and regsvr32.exe.

After the initial infection stage is complete, Qakbot expands its footprint on the infected system and eventually uses encrypted communication with Qakbot command and control (C2) servers to further conceal its activities and evade detection.

Let’s explore four different recent Qakbot infection scenarios to learn exactly how they operate.

Scenario 1: Malicious email with an embedded .hta file, hidden within a OneNote file attachment, leading to multi-stage infection process:
 

• From the malicious email, the user (victim), is led to click a malicious link hidden inside a legitimate looking OneNote file attachment. After clicking the link, the infection chain begins.
  The malicious link is in actuality, an embedded .hta file, executed when the link is clicked. The .hta file includes a VBscript code used to deliver the Qakbot payload and infect the device. Windows uses MSHTA.exe to execute .hta files. Typically, MSHTA.exe is used legitimately to execute HTML applications, and that is why this process usually evades detection as being malicious.

• After the .hta file is initiated, it executes curl.exe to force download an infected dll file from a remote C2 Qakbot server. The Qakbot payload is disguised as an image file to evade detection during the download process. Curl is another normally legitimate tool, used for transferring data over the internet.

• The .hta file then executes the Qakbot dll file using rundll32.exe.
  Rundll32.exe is another normally legitimate Windows application used to run DLL files. In this scenario, executing rundll32.exe allows the malicious DLL file, disguised as an image, to be successfully loaded into the system, undetected.

• Loaded onto the system successfully, Qakbot then hides itself by spawning a new process of wermgr.exe and injecting its code into it. Wermgr.exe is a legitimate Windows Event Log application. Masquerading as a legitimate process enables the malware to run in the background and avoid detection by most common anti-virus software.

Scenario 2: Like Scenario 1, but in this variation, a malicious email with an embedded .cmd file is hidden within a OneNote file attachment, leading to a multi-stage infection process.

• From the malicious email, the user (victim), is led to click the malicious link hidden inside a legitimate OneNote file attachment. After clicking the link, Qakbot begins the infection chain.
  The malicious link is in actuality, an embedded .cmd file, and executes when the link is clicked. Windows uses CMD.exe to execute the .cmd file. CMD.exe is a legitimate command-line interpreter, used to execute commands in Windows operating systems. Being a LOLBin, this process is usually abused to evade detection.

• The .cmd file invokes PowerShell to force download an encrypted payload from a remote Qakbot C2 server.
  PowerShell is a powerful scripting language built into Windows operating systems and is typically used for task automation.

• The downloaded payload dll file is executed using Rundll32.exe, with the same purpose as in the previous scenario.
• Loaded onto the system successfully, Qakbot then hides itself by spawning a new process of wermgr.exe and injecting its code into it.
  

Scenario 3: Malicious email with a Zip attachment bundling a .WSF (Windows Script File) file.

In this variation, a malicious email with an infected WSF file is hidden within a Zip attachment designed to mimic an Adobe Cloud certificate. The Zip file often has a legitimate-looking name and is specifically designed to trick the user (victim) into thinking the attachment is safe and harmless.

• From the malicious email, the user (victim), is led to open the attachment and extract the files it bundles. Inside the Zip there are 3 files: .WSF, PDF and TXT. The PDF and TXT are decoy files, leading the user to click and open the .WSF file, initiating the infection chain.
  Typically, .WSF files contain a sequence of legitimate commands executed by Windows Script Host. In this case, the WSF file contains a script that executes the next stage of the Qakbot infection process.

• An obfuscated script (written in JavaScript), within the malicious .WSF file initiates force download of the payload from a Qakbot C2 server.
• The obfuscated script executes the Qakbot dll using Rundll32.exe.
• Loaded onto the system successfully, Qakbot moves to hide itself, spawning a new wermgr.exe process and injecting its code into it.

Scenario 4: Malicious email with .html attachment using the HTML Smuggling technique

HTML Smuggling is a technique that allows threat actors to smuggle malicious binary code into a system by cloaking the malicious binary within an innocuous looking .html attachment.

• From the malicious email, the user (victim), is led to open the innocuous looking .html attachment containing the hidden binary. In some cases, the .html file arrives within a ZIP archive file, adding an additional step to the complexity of the attack.

• Once opened, the .html file delivers a malicious, password-protected, .ZIP archive file stored within the code of the attachment. The file password is provided in the .html file.

• Inside, the .ZIP archive file, a malicious .img file is bundled.
  IMG are binary files that store raw disk images of floppy disks, hard drives, or optical discs. IMG and ISO files are commonly used legitimately to install large software. In the case of Qakbot, once the IMG file is loaded, it mounts itself as a drive and exposes its contents.
• The malicious .img file actually bundles several other files, including a .LNK (Windows shortcut file) file. Executing the .LNK file initiates the complex infection chain using the other files within the mounted .img file.
• During the infection chain, a malicious .WSF file is executed, invoking PowerShell to force download an encrypted payload (the Qakbot dll) from a remote Qakbot C2 server. PowerShell is a powerful scripting language built into Windows operating systems and is typically used for task automation.

• The .WSF script then executes the Qakbot dll using Rundll32.exe.
• Loaded onto the system successfully, Qakbot moves to hide itself, spawning a new wermgr.exe process and injecting its code into it.

Potential Damage

After Qakbot infects a system, the malware evaluates and performs reconnaissance on the infected environment. If the environment is worthwhile, Qakbot downloads additional tools, such as Cobalt Strike or Brute Ratel frameworks. These frameworks are commercially used by Red Teams for penetration testing purposes.

Unfortunately, leaked versions of many penetration testing frameworks have also found their way to the open market and are abused by threat actors. Using these tools, threat actors perform advanced post-exploitation actions, including privilege escalation, and lateral movement.

Eventually, the greatest threat posed by Qakbot and similar families of malware is ransomware. In some of the most recent attacks, Qakbot has been observed delivering BlackBasta ransomware. BlackBasta is a notoriously effective ransomware variant, used to successfully attack many businesses throughout the US and Europe. BlackBasta uses the double extortion technique, where an attacker demands a ransom payment to restore the victim’s access to their own encrypted files and/or data and threatens to sell the user or organizational data on the Darknet if the ransom is not paid. 

How Cato Protects You Against Qakbot

Qakbot, like other malware, is constantly evolving and being updated with new methods and attempts at infection and infiltration. Making sure your current threat detection solution can detect and block these types of changes to malware threats as quickly as possible is critical to your ongoing organizational security. Cato Networks IPS (Intrusion Prevention System) was immediately updated with the latest changes to Qakbot in order to block the malware from communicating with its C2 servers.

Cato’s Security Research team uses advanced tools and strategies to detect, analyze and build robust protection against the latest threats. The following dashboard view is part of an arsenal of tools used by the Cato Research Team and shows auto-detection of a suspected Qakbot attack and blocking by Cato IPS from any additional communication between the malware and its C2 servers.

It has never been clearer that no company can expect to fight the constant evolution of malware and malicious attacks without help from the experts. Cato’s Security Research team remains committed to continuously monitoring and updating our solutions to protect your organization against the latest threats. Utilizing the Cato Networks solution, enjoy an enhanced overall security posture, safeguard against the ever-evolving threat of malware, and confidently prioritize what truly matters – your business.

To learn more about how Cato protects against Qakbot and similar threats and intrusions and how you can mitigate security risks for your organization, check out our articles on intrusion prevention, security services, and managed threat detection and response.

Indicators of compromise (IOCs)

Scenario #1

352a220498b886fae5cd1fe1d034fe1cebca7c6d75c00015aca1541d19edbfdf – .zip

5c7e841005731a225bfb4fa118492afed843ba9b26b4f3d5e1f81b410fa17c6d – .zip

002fe00bc429877ee2a786a1d40b80250fd66e341729c5718fc66f759387c88c – .one

d1361ebb34e9a0be33666f04f62aa11574c9c551479a831688bcfb3baaadc71c – .one

9e8187a1117845ee4806c390bfa15d6f4aaca6462c809842e86bc79341aec6a7 – .one

145e9558ad6396b5eed9b9630213a64cc809318025627a27b14f01cfcf644170 – .hta

baf1aef91fe1be5d34e1fc17ed54ea4f7516300c7b82ebf55e33b794c5dc697f – .hta

Scenario #2

1b553c8b161fd589ead6deb81fdbd98a71f6137b6e260c1faa4e1280b8bd5c40 – .one

e1f606cc13e9d4bc4b6a2526eaa74314f5f4f67cea8c63263bc6864303537e5f – .one

06a3089354da2b407776ad956ff505770c94581811d4c00bc6735665136663a7 – .cmd

5d03803300c3221b1233cdc01cbd45cfcc53dc8a87fba37e705d7fac2c615f21 – .cmd

Scenario #3

1b3b1a86a4344b79d495b80a18399bb0d9f877095029bb9ead2fcc7664e9e89c – .zip

523ea1b66f8d3732494257c17519197e4ed7cf71a2598a88b4f6d78911ad4a84 – .zip

fe7c6af8a14af582c3f81749652b9c1ea6c0c002bb181c9ffb154eae609e6458 – .wsf

6d544064dbf1c5bb9385f51b15e72d3221eded81ac63f87a968062277aeee548 – .wsf

Scenario #4

3c8591624333b401712943bc811c481b0eaa5a4209b2ec99b36c981da7c25b89 – .html

8c36814c55fa69115f693543f6b84a33161825d68d98e824a40b70940c3d1366 – .html

2af19508eebe28b9253fd3fafefbbd9176f6065b2b9c6e6b140b3ea8c605ebe8 – .html

040953397363bad87357a024eab5ba416c94b1532b32e9b7839df83601a636f4 – .html

42bd614f7452b3b40ffcad859eae95079f1548070980cab4890440d08390bd29 – .zip

08a1f7177852dd863397e3b3cfc0d79e2f576293fbb9414f23f1660345f71ccc – .zip

0d2ad33586c6434bd30f09252f311b638bab903db008d237e9995bfda9309d3a – .zip

878f3ccb51f103e00a283a1b44bb83c715b8f47a7bab55532a00df5c685a0b1d – .zip

B087012cc7a352a538312351d3c22bb1098c5b64107c8dca18645320e58fd92f – .img

Qakbot payload

d6e499b57fdf28047d778c1c76a5eb41a03a67e45dd6d8e85e45bac785f64d42

6decda40aeeccbcb423bcf2b34cf19840e127ebfeb9d79022a891b1f2e1518c3

e99726f967f112c939e4584350a707f1a3885c1218aafa0f234c4c30da8ba2af

5d299faf12920231edc38deb26531725c6b942830fbcf9d43a73e5921e81ae5c

acf5b8a5042df551a5fe973710b111d3ef167af759b28c6f06a8aad1c9717f3d

442420af4fc55164f5390ec68847bba4ae81d74534727975f47b7dd9d6dbdbe7

ff0730a8693c2dea990402e8f5ba3f9a9c61df76602bc6d076ddbc3034d473c0

bcfd65e3f0bf614bb5397bf8d4ae578650bba6af6530ca3b7bba2080f327fdb0