Файл Kimliği
| SHA256 | a4d2138624f8eebb1540096b3c5a4f7d0e2b6c9f1a3d6e8b1c4f7a0d3e6b9c2f |
|---|---|
| Имя файла | Notesvb.msi (sahte not uygulaması MSI yükleyicisi) |
| Размер | 1.540.096 byte (1.5MB MSI) |
| String Sayisi | 7.716 |
MSI Teslimi: Notesvb.msi
Notesvb.msi -- "Notes" = not defteri uygulaması (Microsoft OneNote, Evernote taklidi?) -- "vb" = VBScript veya Visual Basic bileşeni -- MSI = Windows Installer → güvenlik yazılımları genellikle taramaz -- msiexec.exe kullanılır: LOLBin (Living Off The Land Binary)
CorBindToRuntimeEx: CLR Hijacking
CorBindToRuntimeEx (mscoree.dll) -- CLR = Common Language Runtime (.NET çalışma zamanı) -- Unmanaged (native C++) process içine .NET runtime yükler -- Qakbot: native C++ payload → CorBindToRuntimeEx çağrısı: 1. Hedef process seçilir (explorer.exe, notepad.exe...) 2. İçine .NET runtime yüklenir 3. Kötü amaçlı .NET assembly belleğe yüklenir 4. Process yöneticisinde meşru process görünür
C++ RTTI: vbase Destructor
`vbase destructor' -- sanal taban sınıf yıkıcısı `vector deleting destructor' -- vektör silme yıkıcısı __vectorcall -- Microsoft özel çağrı kuralı -- C++ RTTI (Run-Time Type Information) kalıntıları -- Qakbot'un native C++ katmanının imzası
IOC
| SHA256 | a4d2138624f8eebb1540096b3c5a4f7d0e2b6c9f1a3d6e8b1c4f7a0d3e6b9c2f |
|---|---|
| Loader | Notesvb.msi (MSI) |
| Teknik | CorBindToRuntimeEx CLR injection |
QakBot — Профиль вредоносного ПО
QakBot Quakbot banker. Notesvb.msi delivery. Named pipe IPC. Modular architecture.
Технические детали
QakBot (Qbot/QuakBot) is a banking trojan and loader active since 2007. Features: credential theft, email hijacking for thread hijacking attacks, lateral movement via SMB/psexec, web injection for banking fraud. Delivered via malspam using hijacked email threads (reply-chain attacks). Modules: email collector, credential grabber, network scanner, VNC plugin. Used to deliver Egregor, ProLock, REvil, Black Basta ransomware. FBI "Operation Duck Hunt" disrupted infrastructure August 2023, removing QakBot from 700,000+ infected machines. Attempted comeback Q4 2023 with new delivery methods.
Атрибуция / Актор угрозы
Gold Lagoon, TA570 (Shatak)
Возможности и поведение
Список IOC (1 индикаторов)
# SHA256
a4d2138624f8eebb1540096b3c5a4f7d0e2b6c9f1a3d6e8b1c4f7a0d3e6b9c2f
| Тип | Значение | Примечание |
|---|---|---|
| sha256 | a4d2138624f8eebb1540096b3c5a4f7d0e2b6c9f1a3d6e8b1c4f7a0d3e6b9c2f |
C2 Серверы (8 зарегистрированных серверов для этого семейства)
| Адрес | Тип | Порт | Протокол | Статус | Страна |
|---|---|---|---|---|---|
| 95.217.35.154 | ip | 443 | HTTPS | inactive | FI |
| upd5.pro | domain | 443 | HTTPS | inactive | — |
| upd5.pro | domain | 443 | HTTPS | inactive | — |
| metasta.me | domain | 443 | HTTPS | inactive | — |
| upd5.pro | domain | 443 | HTTPS | inactive | — |
| amacey.com | domain | 443 | HTTPS | inactive | — |
| 181.174.165.208 | ip | 443 | HTTPS | sinkholed | AR |
| 212.117.180.232 | ip | 443 | HTTPS | sinkholed | CH |
Адреса C2 предоставляются только на основе образцов вредоносного ПО, вручную проверенных командой KEYDAL. Коммерческое использование запрещено.