0

QBot is a banking trojan that's over 12 years old. Recently it received some updates as documented by F5 labs here: https://www.f5.com/labs/articles/threat-intelligence/qbot-banking-trojan-still-up-to-its-old-tricks

What I'm confused about is what they mean when they list the 40+ banks that it targets. They even include the URLs that are targeted, but nowhere in the report or other news articles can I find what it actually does with those URLs. Does it try to extract cookies for those pages? Does it only activate the keylogger when those pages are visited? Does it put capture overlays on those pages?

0

1 Answer 1

1

I've known this malware by the name of Qakbot, but even from the article you have linked:

This appears to be a dedicated campaign with a browser hijack, or redirection, as the main attack method when the machine is infected. As Qbot watches a victim’s web traffic, it looks for specific financial services from which to harvest credentials.

Typically malware will either record keystrokes and/or inject itself into a browser process. From BleepingComputer's article:

Some of the techniques Qbot uses to steal sensitive information:

Keylogging – Qbot captures and sends every keystroke that the victim enters and uploads them to the attacker.
Credentials/cookies – Qbot searches for saved credentials/cookies from browsers and sends them to the attacker.
Hooking – the main payload injects to all the processes in the system with a code that hooks API calls and searches for financial/banking string the malware extracts the data, credentials, or session cookies from the process and uploads it to the attacker.

It probably does this with a user mode hook, so anything the OS handles internally is likely safe. Obviously the attackers can gain administrative privileges at some point, so that is subject to change.

1
  • I found this website which went into it with more depth: any.run/malware-trends/qbot. Basically it steals session data for those websites and performs web-injects.
    – trallgorm
    Commented Jun 19, 2020 at 3:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .