QBot is delivered via spearphishing emails with attachments in multiple languages, using real business correspondence to entice victims to open a PDF. The malware chain uses a WSF/JS script, decodes a PowerShell payload, downloads a DLL, and loads QBot to steal credentials and potentially install extra payloads like CobaltStrike. #QBot #QakBot #QuackBot #Pinkslipbot #CobaltStrike
Keypoints
- QBot distribution now heavily relies on business‑style emails with PDF attachments in several languages (English, German, Italian, French).
- Emails imitate real correspondence and spoof sender details to bypass spam checks and increase legitimacy.
- The attack chain begins with a PDF that leads to a Windows Script File (WSF) containing obfuscated JScript.
- Deobfuscation reveals a PowerShell script encoded in Base64 that downloads a DLL from remote servers and executes it via rundll32.
- QBot’s capabilities include credential and cookie theft, mailbox access, traffic interception, and remote control, with potential loading of additional malware like Cobalt Strike for lateral movement or proxying.
- Campaign activity was substantial in early April (thousands of emails), with Germany, Argentina, and Italy as top targets.
MITRE Techniques
- [T1566.001] Spearphishing Attachment – The QBot delivery scheme begins with an e-mail letter with a PDF file in the attachment being sent. “The QBot malware delivery scheme begins with an e-mail letter with a PDF file in the attachment being sent.”
- [T1204] User Execution – Such letters urge the addressee under a plausible pretext to open an enclosed PDF file. “Such simulated business correspondence can obstruct spam tracking while increasing the probability of the victim falling for the trick.”
- [T1027] Obfuscated/Compressed Files and Information – In the downloaded archive there is a .wsf file containing an obfuscated script written in JScript. “In the downloaded archive there is a .wsf (Windows Script File) file containing an obfuscated script written in JScript.”
- [T1059.001] PowerShell – The WSF file reveals a PowerShell script encoded into a Base64 line, which is later decoded and executed. “After the WSF file is deobfuscated its true payload gets revealed: a PowerShell script encoded into a Base64 line.”
- [T1105] Ingress Tool Transfer – The PowerShell script will try to download the DLL from remote servers. “The PowerShell script will try in succession to download the file from each one of the URLs listed in the code.”
- [T1218.011] Signed Binary Proxy Execution: Rundll32 – The downloaded library is run with the help of rundll32. “The downloaded library is the Trojan known as QBot … run with the help of rundll32.”
- [T1021] Remote Services / Lateral Movement – The bot can download additional malware like Cobalt Strike to spread through the corporate network. “depending on the value of the victim, additional malware can be downloaded locally, such as CobaltStrike (to spread the infection through the corporate network) or various ransomware.”
Indicators of Compromise
- [MD5] PDF files – 253E43124F66F4FAF23F9671BBBA3D98, 39FD8E69EB4CA6DA43B3BE015C2D8B7D
- [MD5] ZIP archives – 299FC65A2EECF5B9EF06F167575CC9E2, A6120562EB673552A61F7EEB577C05F8
- [MD5] WSF files – 1FBFE5C1CD26C536FC87C46B46DB754D, FD57B3C5D73A4ECD03DF67BA2E48F661
- [MD5] DLL – 28C25753F1ECD5C47D316394C7FCEDE2
- [URL] Malicious links – cica.com[.]co/stai/stai.php, abhishekmeena[.]in/ducs/ducs.php
- [URL] Malicious links – rosewoodlaminates[.]com/hea/yWY9SJ4VOH, agtendelperu[.]com/FPu0Fa/EpN5Xvh
Read more: https://securelist.com/qbot-banker-business-correspondence/109535/