#threatreport #HighCompleteness
Qbot is Back.Connect | 27-01-2025
Source:Key details below ↓

💀Threats:
Qakbot, Dns_tunneling_technique, Z_loader, Blackbasta, 
🏭Industry: Financial

🤖LLM extracted TTPs:`
T1573, T1105, T1547

🧨IOCs:
 - File: 7
 - Hash: 11
 - IP: 2
 - Url: 3
 - Path: 3
 - Domain: 1

🔢Algorithms: sha256, zip, rc4

🗂️Win API: createprocess, exitprocess

YARA: Found

#threatreport:
QBot, also known as Qakbot or Pinkslipbot, is a modular information stealer that has been active since around 2007. Initially categorized as a banking Trojan, QBot steals financial information from infected systems and serves as a loader utilizing Command and Control (C2) servers for targeted payload execution. On May 30th, 2024, Law Enforcement conducted an operation against the QBot operators to disrupt their activities. While this action initially disrupted their operations, signs indicate a possible re-emergence of the threat actors.

Notably, research by ZScaler uncovered the integration of DNS tunneling into Zloader, revealing overlaps with QBot. Analysis of a sample highlighted references to QBot within the PDB information. Specific strings related to certain commands were linked back to the law enforcement takedown of QBot. Furthermore, the emergence of a new backConnect malware developed by QBot operators suggests potential ties to ransomware operations, notably the BlackBasta ransomware group. There is a high likelihood that this new backConnect malware will be utilized in ransomware attacks. To aid in detection efforts, a YARA rule has been released to identify samples associated with these threats.

The connection between Zloader activity, BlackBasta ransomware operations, and the development of backConnect malware by QBot operators underscores the evolving threat landscape. The persistence and adaptability of threat actors pose significant challenges to cybersecurity professionals and law enforcement agencies. Continued monitoring, collaboration, and timely responses are crucial to mitigating the risks posed by such sophisticated threats.