QAKBOT is observed using valid code signing certificates to sign malicious modules, enabling trusted-looking infections. The article reviews infection timelines, potential origins of abused certificates, and recommended countermeasures. #QAKBOT #Follina
Keypoints
- QAKBOT and EMOTET have been highly active, with Black Basta ransomware operators using QAKBOT for entry and references to the Follina vulnerability (CVE-2022-30190).
- Recent observations show QAKBOT modules signed with multiple valid code signing certificates, implying access to private keys.
- Abuse scenarios include certificates issued to real micro-companies, identity theft, and unusual certificate issuance details (e.g., same free email service across certs, IP updates before issuance).
- Historically, code signing abuse has appeared in Stuxnet, Flame, and other cases; Doowon Kim’s CSS’17 study documented numerous stolen keys and certificates from trusted CAs.
- In June–July 2022, Trend Micro observed at least seven certificates in use by QAKBOT within a short window, signaling ongoing abuse.
- Defensive guidance emphasizes stronger private-key protection (hardware tokens, cloud signing), monitoring identity and domain authenticity, and improving certificate revocation checks and CT log limitations for code signing.
MITRE Techniques
- [T1116] Code Signing – QAKBOT uses valid code signing certificates to sign modules, making them appear legitimate. Quote: “…modules related to QAKBOT shows multiple samples that have been signed with multiple valid code signing certificates…”
- [T1003] Credential Dumping – Mimikatz is used to dump certificates and private keys during operations. Quote: “Mimikatz, which provides certificate and private key dumping capabilities.”
- [T1003] Credential Dumping – PFXExportCertStore() API is used to dump private keys, enabling export of credentials. Quote: “QAKBOT calls PFXExportCertStore() for dumping private keys.”
Indicators of Compromise
- [File Name] context – Trojan.Win32.QAKBOT.DRSO, TrojanSpy.Win32.QAKBOT.YXCGSZ, and 5 more file names (from the IOCs table)
- [File Hash] context – adadda4d61188c53c25323a3561db52d14a5dbb2585a53e18b33882f1013b9ee, 78bc13074087f93fcc8f11ae013995f9a366b6943330c3d02f0b50c4ae96c8a7, and 5 more hashes