The creator of the Qbot malware, or someone with access to the malware's source code, appears to be experimenting with new versions as a new variant has been released that uses fake Adobe installer popups.
See also: QakBot (QBot) malware is back – New phishing attack
QBot has been operating for many years as a loader for various malicious payloads, including ransomware malware, delivered primarily via email to victims.
Until its deactivation last August, QBot had infected over 700,000 systems and in just 18 months caused financial damages estimated at more than 58 million dollars.
Codenamed Duck Hunt, the operation did not result in any arrests, and many security researchers believed that Qbot's developers would rebuild their infrastructure and restart distribution campaigns.
Last year, Cisco Talos reported on a Qbot operation that had been launched before it was taken down, and was still active in October. Researchers believe this was possible because the researchers only neutralized the servers and not the spam delivery infrastructure.
The new Qakbot variant uses improved obfuscation techniques, including advanced encryption to hide strings and command and control (C2) communication. Specifically, the malware uses AES-256 encryption on top of the XOR method seen in previous samples.
See also: DarkGate and PikaBot malware fill the gap left by Qakbot (QBot)
The malware checks the terminal protection software and reinserts checks for virtual environments, attempting to avoid detection by entering an infinite loop if it is found in a virtual machine.
Additionally, the Qbot variant displays a deceptive popup indicating that Adobe installation is running on the system, with the aim of tricking users into installing deceptive updates that run the malware regardless of where users click.
Sophos researchers say that by closely monitoring the development of QBot, they can update their detection rules and share critical information with other security vendors.
Although a small number of samples emerged after Qbot's C2 infrastructure was taken down last year, the researchers believe that "any activity by malicious actors to restore it is worth monitoring and examining."
See also: Formbook is the most widespread malware
How can we protect ourselves from Qbot Malware?
To protect yourself from Qbot Malware, you must first keep your operating system and software up to date. These updates often include security fixes that can address the vulnerabilities exploited by Qbot.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Additionally, you should use a reliable antivirus program that can detect and remove Qbot. It is important to keep this software updated, as new variants of Qbot may not be detected by older versions of security software. Another important strategy is training in recognizing and avoiding phishing attacks, which Qbot often uses to spread itself. This may involve learning how to recognize suspicious emails or messages, and avoiding clicking on links or opening attached files from unknown sources.
Finally, you should regularly back up your important data. If your system is infected by Qbot, this can help you restore data without having to pay for decryption.
Source: bleepingcomputer
