QBot: Omstillingsparat malware kaprer mailtråde

Grupper af cyberkriminelle samarbejder, og det har blandt andet ført til, at der nu er en lille gruppe af malware-familier, som hyppigt bliver brugt i de tidlige faser af et cyberangreb. Derfor er det en god idé at kende disse familier og holde øje med dem på netværket.

I januar 2021 beskrev Center for Cybersikkerhed (CFCS), hvordan tilstedeværelsen af bestemte typer malware kan være et tegn på, at et ransomware-angreb er under opsejling. I forlængelse heraf har CFCS udgivet tekniske indikatorer for Gozi, SmokeBot og Bazar.

Denne gang har CFCS set nærmere på malwarefamilien QBot, der også er kendt som QakBot, QuakBot eller PinkslipBot. Det er malware, der har rødder tilbage til 2007, men løbende har udviklet sig. Cyberkriminelle har blandt andet brugt QBot i cyberangreb, der i sidste ende ledte til kryptering med DoppelPaymer ransomware.

Skifter IP-adresser

En del af QBots udvikling over tid har haft fokus på at gøre det vanskeligere at detektere malwaren. Det er sandsynligt, at QBot tilpasser sig over kortere tidsrum ved for eksempel at udskifte de IP-adresser, malwaren hyppigt bruger til at kontakte den bagvedliggende infrastruktur (Command & Control eller C2).

I et udtræk med en uges mellemrum af eksemplarer uploadet til Virustotal-tjenesten i december 2020, kunne man for eksempel se, at QBot-varianterne den ene uge indeholdt samlet 293 IP-adresser og i den næste uge 191 IP-adresser. Der var blot et overlap på 84 IP-adresser mellem de to uger.

Ifølge åbne kilder tilhører IP-adresserne kompromitterede servere, som Qbot benytter mellem malwaren og selve den infrastruktur, som benyttes til at kontrollere malwaren. Disse kompromitterede servere fungerer udelukkende som proxies.

Det er muligt, at aktører bag QBot følger med i, hvilke IP-adresser og andre tekniske indikatorer der offentliggøres, og derefter tilpasser malwaren.

På grund af denne hyppige udskiftning af IP-adresser, er det vanskeligt at detektere QBot alene ud fra observerede IP-adresser.

Avanceret phishing med Office-dokumenter og ZIP-filer

QBot bliver hovedsageligt spredt gennem phishing. Det kan være vedhæftede filer eller links til blandt andet Office-dokumenter. For eksempel Excel-regneark der indeholder en makro og instruktioner til modtageren om at tillade afvikling af makroen for at se indholdet. Det kan også være i ZIP-filer.

I begge tilfælde vil en lille stump programkode forsøge at downloade og køre det næste stadie i QBot-infektionskæden.

En særligt farlig egenskab ved QBot er, at den kan misbruges til at udføre mere sofistikerede phishing-angreb såsom ”e-mail thread hijacking”. Ved e-mail thread hijacking misbruger aktøren sin adgang til et offers e-mail konto til at udsende phishing-mails til offerets kontakter i form af svar på igangværende e-mailkorrespondancer. Fra modtagerens perspektiv kommer de inficerede mails derfor fra en troværdig afsender i naturlig forlængelse af allerede etablerede samtaler.

Ligesom QBot løbende skifter IP-adresser, forsøger aktørerne også at undgå detektion ved at sløre programkoden eller kryptere dele af malwaren. Ligesom flere andre malware-familier vil den også forsøge at undgå at blive afviklet i en ”sandbox”, som flere antimalware-programmer benytter for at opdage ondsindet kode.

Indikatorer for QBot

Nedenfor har CFCS samlet en liste over tekniske indikatorer (Indicators of Compromise eller IoC’er) baseret på fundne eksemplarer af nyere dato. Indikatorerne er også tilgængelige som en tekstfil.

Da malwaren kan bruges som brohoved ind på en organisations netværk, kan tilstedeværelsen af QBot være et tegn på, at nogen forsøger eller allerede har forsøgt at stjæle sensitive data eller vil forsøge at udføre et ransomware-angreb.

Da QBot løbende tilpasses, kan det være vanskeligt at anvende IP-adresserne på proxy-serverne eller hashværdier af malwaren til detektion for at opdage et angreb, når det finder sted. Til gengæld kan IoC’erne have værdi, hvis man har log-filer og har mulighed for at se, om der har været trafik fra de pågældende IP-adresser. Det kan give et fingerpeg om, at nogen har forsøgt at angribe.

Se også: ”Logning – en del af et godt cyberforsvar”

IoC’erne kan også anvendes, hvis man har mistanke om, at et angreb har fundet sted og har de fornødne log-filer. Det kan være en hjælp i undersøgelse af angrebet og genopretning af systemer, hvis man kan identificere malwaren eller aktøren.

Filhashes (SHA-256)

d749de8a8d8bfdcffe6f0eaa83bbf3605027da45bf27767e4bc4a09dfe8eadc0
5d67dda7a5f6e334fc758afdaa6eba26ab23eb74c04f8010c980ff890e57d77a
9587b0d2e91f7b00878a77b75349f608e75df2eae0fbe4327e96552f17626673
3baf239a04d47d0157e9fc04b109501507205312efdfc57492ecd37038c3af49
158e82c396ab09f4a0be69fc4b364d9a5d6f75619dad34e2d9a6cd89258ee700
45f579bf197662c108d0747abc592d839eaf3986d68f05f19e4f28ca34266b8d
bfa5962181eb03ef21eb2a0c743386e42563c3a26d112e0eee0551fe0536d084
c640e5e5b1736c1c36d4df952fa8f9bfe695bdfa8ce7f0a2f37b831b4e215d87
76497271baf0e5eed1ff2f15a85f846fcebd9976c9cd53b50023a35379f7db6b
1fc260d02822e2d3508d0869718ec01b777a05ec2a0cfed7b221e7e9943c5c42
982369547a91c40c1e6087c0212abb22a2a7628f08795e5f8120a32c57f74556
68253b4899847aace8e1bbdd71a7146210bde5294a6b917c4d8ae2a1d00e3b82
b65bda06d87a71396ac8b601c5b7f026b820efb158209b7d766b7c1d57638915
9bfe9e4e8944c53e8a77685d1395a538a9c760ba23dac1159e5627067985cb1c
930a13c3dda9b49a354b90808c4fdd829ea0bd8d5017bd55949a7230fbdee878
c1c750664e264aef306dfd5aa8e3a80ff6660f7df17d295e2bfd8bf4fcccfc5b
c78116deb1267f56f5cdd725d5482bffcf13f850e4c94a7ba7ea147a0dad9f23
bdc33b92d6b592b4a114ce8385b5051108165b17f8fd7b6c7ea987a233a604dd
deac3b2154d9f722f238ddf683f71111400b9923458d2b3f91ada152cc0c6e1c
d06a81229d4885904778d2a5a9b10b1d06314e378e48b962de60bd6e6d201ab7
3123295f987a61b30682e06435daead9060a4a30dff50a1b9260a9e24072f671
b101eaf7616e9bf7e793c9aa8061ba095dc6478d73015ebbaea73653ab3802ce
9bf2681936068e13ca37af9a4967a00c38329e11221b3f18474ba30ec3e83982
e138574d0d22e817f5414fe5b8de1bb041eded716d0874de44d052e28f302220
f36f0f84bee5551d134394ec555ccf6486f510893c2504656a2ba2d21813ecb0
c807b758a9a6d09c81c50efb230a218fd92b981c5a930fe2c0aeb7409c915aef
f51bb0050eb1c38ff59cc149eeaffeb6fd565f1f159ca7fc3c6a4fa8046c7f2c
b489b63edfcdab483dfde3663ee0945c10196d7a242d9466e22e37e336926676
daf25e2551c268a8e88b60cf7a759f3e3111df22c6777dd6d4e91106a8277b6d
fe11f3e19b92a1397760794f6062999d33605231a86c01ed2ad13d985ac913e0
fc5f6cd8792c1c7402ca218ace260d230fb13abdc25dbe5b7222447a815af80b
ec5eee0d5fe6e706425a0b3772e2a0839371bfde4d5d1f28058b5bb159b2b301
54b51ce8544310f10de68fa2ac050b03d4e33ae78dc7269bd3f0f6447384a12b
e0ff62e457a23885d0f5b0c0c1a51b6eea0fb25c07810eec204bf35f0a6331ac

IP-adresser (med porte)

1.43.86.247:2222
2.191.77.18:443
2.7.202.106:2222
2.90.186.243:995
5.14.152.241:443
5.70.178.62:443
24.152.219.253:995
24.206.4.203:2222
24.27.82.216:2222
24.71.28.247:443
31.46.48.119:443
37.104.30.154:995
37.130.115.124:443
37.210.133.63:995
39.36.30.92:995
41.176.34.7:995
41.233.153.21:993
41.43.94.207:995
45.118.65.34:443
45.77.193.83:443
47.146.34.236:443
47.22.148.6:443
50.244.112.10:995
51.235.24.196:443
59.103.76.230:443
59.99.37.18:443
64.185.5.157:443
65.48.179.252:443
67.141.11.98:443
67.40.253.209:995
67.82.244.199:2222
68.15.109.125:443
68.192.50.231:443
68.46.142.48:995
69.47.239.10:443
70.92.123.49:443
71.163.223.144:443
71.220.164.199:443
72.182.209.97:2222
72.241.205.69:443
72.36.59.46:2222
73.136.242.114:443
73.244.83.199:443
73.55.254.225:443
74.129.26.119:443
74.195.52.3:443
75.136.26.147:443
77.132.113.187:2222
77.27.174.49:995
78.101.234.58:443
78.181.19.134:443
78.63.226.32:443
79.112.110.20:443
79.119.124.237:443
80.106.85.24:2222
80.227.5.70:443
81.214.126.173:2222
82.10.43.130:2222
82.76.47.211:443
83.196.50.197:2222
84.224.55.148:995
85.121.42.12:995
85.204.189.105:443
86.121.3.80:443
86.189.252.131:2222
86.97.221.121:443
87.238.133.187:995
89.137.77.237:443
89.87.231.187:2222
90.23.117.67:2222
91.228.36.95:443
92.59.35.196:2083
93.149.253.201:2222
94.26.119.221:443
94.69.242.254:2222
95.76.27.6:443
96.225.88.23:443
96.247.180.108:443
96.41.93.96:443
98.118.156.172:443
98.199.189.220:61202
98.4.227.199:443
102.187.19.171:443
103.76.160.110:443
106.51.85.162:443
108.30.125.94:443
109.154.193.21:2222
110.142.205.182:443
113.22.243.219:443
120.150.60.189:995
121.58.199.24:443
134.228.24.29:443
143.178.135.25:2222
149.135.101.20:443
151.33.226.156:443
151.75.13.83:443
156.213.147.56:443
161.142.217.62:443
166.62.183.139:2078
172.87.134.226:443
173.197.22.90:2222
174.20.161.243:995
174.62.13.151:443
175.140.23.200:443
178.222.114.132:995
180.233.150.134:443
182.161.6.57:3389
184.89.71.68:443
185.125.151.138:443
186.189.208.238:443
187.149.129.239:443
187.213.136.249:995
188.24.183.193:443
188.52.193.110:995
189.140.45.48:995
189.172.247.56:443
189.250.115.177:2222
190.220.8.10:993
193.248.154.174:2222
196.204.207.111:443
197.206.132.79:443
197.51.82.115:995
199.19.117.131:443
200.75.136.78:443
202.184.106.235:443
207.246.75.201:443
211.24.72.253:443
216.215.77.18:2078
217.165.3.30:443
219.74.176.225:443
2.132.32.23:995
2.49.219.254:22
2.86.41.23:2222
5.107.34.225:22
5.15.225.109:443
24.122.0.90:443
24.178.196.158:443
24.229.150.54:995
24.37.178.158:443
24.95.61.62:443
31.5.21.66:995
37.106.60.237:995
37.150.50.72:995
37.211.86.156:443
39.45.175.245:995
41.205.16.89:443
41.237.210.179:995
41.96.167.79:443
45.250.69.150:443
46.124.107.124:6881
47.187.49.3:2222
47.24.47.218:443
50.29.166.232:995
58.152.9.133:443
59.89.129.103:443
61.1.205.150:443
65.131.47.74:995
65.60.131.184:2222
67.177.196.177:0
67.6.54.180:443
68.116.193.239:443
68.184.45.73:443
68.224.121.148:993
69.11.247.242:443
70.118.146.154:995
71.10.43.79:443
71.182.142.63:443
71.226.140.73:443
72.190.101.70:443
72.252.201.69:443
72.66.47.70:443
73.166.10.38:443
73.248.120.240:443
73.56.2.167:443
74.134.184.114:443
74.73.27.35:443
75.170.145.25:443
77.145.0.57:2222
77.30.79.74:443
78.132.96.100:6881
78.184.6.94:443
78.96.199.79:443
79.113.3.236:443
79.129.216.215:2222
80.11.5.65:2222
80.240.26.178:443
81.247.148.252:995
82.12.157.95:995
82.79.35.131:443
83.202.68.220:2222
84.232.252.202:2222
85.122.141.42:995
85.52.72.32:2222
86.122.248.164:2222
86.218.67.235:2222
86.98.34.84:995
87.27.110.90:2222
89.3.198.238:443
90.101.117.122:2222
90.53.103.229:2222
92.137.138.52:2222
93.113.177.152:443
93.177.172.131:443
94.49.247.223:443
94.98.242.243:443
95.77.144.238:443
96.227.127.13:443
96.27.47.70:2222
97.119.234.37:443
98.121.187.78:443
98.240.24.57:443
99.244.210.10:443
103.102.100.78:2222
105.101.90.203:443
108.160.123.244:443
108.31.15.10:995
109.205.204.229:2222
110.159.80.243:443
116.240.78.45:995
120.151.95.167:443
122.59.40.31:995
136.232.34.70:443
144.139.47.206:443
149.28.99.97:2222
151.56.214.79:443
155.186.9.160:443
156.220.32.217:995
161.199.180.159:443
172.114.116.226:995
172.89.144.89:0
173.21.10.71:2222
174.29.203.226:993
174.76.21.134:443
176.181.247.197:443
178.223.20.246:995
181.129.155.10:443
182.48.138.42:443
184.97.145.239:443
185.138.134.150:443
186.29.96.147:443
187.153.119.36:443
187.227.86.129:995
188.25.175.46:443
188.54.36.19:995
189.141.31.12:443
189.183.209.211:443
189.252.62.238:995
190.67.214.66:443
193.83.25.177:995
196.89.180.164:443
197.210.96.222:995
197.86.204.201:443
199.247.22.145:443
201.152.69.198:995
202.185.199.172:443
207.255.18.67:443
212.70.107.59:995
217.128.117.218:2222
217.39.74.146:2222
219.76.148.249:443
2.133.215.76:995
2.50.56.81:443
2.88.67.161:995
5.12.254.113:443
5.193.175.76:2078
24.138.77.61:443
24.179.13.119:443
24.244.161.36:443
24.40.173.134:443
27.223.92.142:995
32.212.117.188:443
37.107.82.136:443
37.182.244.124:2222
37.234.175.105:995
39.61.33.253:995
41.227.76.249:443
41.239.137.134:993
41.97.183.51:443
45.32.162.253:443
46.152.122.110:443
47.208.8.187:443
47.44.217.98:443
50.60.166.59:995
58.179.21.147:995
59.96.59.100:443
62.38.114.12:2222
65.29.116.74:443
66.26.160.37:443
67.237.68.126:2222
67.61.157.208:443
68.131.19.52:443
68.186.192.69:443
68.225.60.77:995
69.123.179.70:443
70.124.29.226:443
71.126.139.251:443
71.187.170.235:443
71.28.164.56:995
72.204.242.138:443
72.28.255.159:995
72.79.79.92:0
73.200.219.143:443
73.32.115.251:443
74.124.191.6:443
74.135.112.78:443
74.75.237.11:443
76.104.230.174:443
77.159.149.74:443
77.42.111.222:32100
78.154.31.238:443
78.187.125.116:2222
78.97.110.47:443
79.114.166.171:2222
79.166.96.86:2222
80.14.22.234:2222
81.133.234.36:2222
81.88.254.62:443
82.127.125.209:20
83.110.74.173:443
84.117.176.32:443
84.78.128.76:2078
85.132.36.111:2222
85.60.132.8:2087
86.125.205.97:443
86.245.87.251:2222
86.99.134.235:2222
88.106.237.152:2222
89.32.220.24:443
90.174.217.251:2222
91.104.235.91:995
92.154.83.96:2078
93.146.133.102:2222
93.51.28.161:2222
94.52.160.116:443
95.159.45.82:443
96.19.117.140:443
96.237.141.134:995
96.37.113.36:993
97.69.160.4:2222
98.124.76.187:443
98.26.50.62:995
101.185.175.169:2222
103.110.6.151:2087
105.103.33.188:443
108.190.151.108:2222
108.46.145.30:443
109.209.94.165:2222
110.53.221.119:443
117.215.193.210:443
120.159.238.185:2222
123.136.59.45:443
140.82.27.132:443
144.202.38.185:995
151.16.241.219:443
151.60.163.18:443
156.194.205.151:995
156.222.155.185:995
162.157.19.33:2222
172.116.85.178:443
173.173.1.164:443
173.3.106.172:2222
174.54.24.110:995
174.87.65.179:443
176.45.233.94:995
178.80.62.24:443
181.169.88.203:443
184.179.14.130:22
184.98.97.227:995
185.163.221.77:2222
187.136.203.196:443
187.190.250.175:443
187.7.236.197:995
188.26.243.119:443
189.131.107.239:995
189.150.40.192:2222
189.210.115.207:443
189.90.97.134:2222
190.75.167.44:2222
195.97.101.40:443
197.135.132.247:443
197.36.100.188:995
198.2.35.226:2222
200.110.188.218:443
201.170.194.40:995
203.106.195.67:443
208.93.202.41:443
216.137.142.200:2222
217.133.54.140:32100
218.227.162.13:443
2.190.10.89:995
2.51.240.250:995
2.89.183.206:443
5.13.84.186:995
5.2.188.253:443
24.139.72.117:443
24.201.61.153:2078
24.255.176.233:443
24.43.22.220:993
31.215.68.98:2222
35.134.202.234:443
37.116.152.122:2078
37.209.252.242:443
39.32.79.66:995
41.104.58.86:443
41.228.197.242:443
41.39.134.183:443
42.201.228.106:995
45.63.107.192:2222
46.177.174.186:443
47.21.192.182:2222
49.3.214.157:2222
51.223.61.13:443
58.187.41.55:443
59.98.96.143:443
63.155.29.193:995
65.30.213.13:6882
66.97.247.15:443
67.249.12.146:443
67.8.103.21:443
68.134.181.98:443
68.190.152.98:443
68.39.160.40:80
69.40.22.180:443
70.45.219.126:443
71.14.110.199:443
71.197.126.250:443
71.74.12.34:443
72.240.200.181:2222
72.29.181.78:2222
73.121.132.5:443
73.239.229.107:995
73.51.245.231:995
74.128.121.17:443
74.137.189.78:443
75.109.180.221:443
76.181.122.120:443
77.211.30.202:995
77.76.9.40:443
78.162.70.119:443
78.189.29.95:443
79.101.206.250:995
79.115.171.106:2222
79.172.26.240:443
80.195.103.146:2222
81.150.181.168:2222
81.97.154.100:443
82.223.205.216:443
83.114.243.80:2222
84.120.99.206:443
85.105.29.218:443
85.186.122.190:443
85.98.177.32:443
86.162.13.35:2222
86.248.30.56:2222
87.218.53.206:2222
89.136.12.221:2222
89.33.87.107:443
90.175.88.99:2222
91.138.177.114:2222
92.177.56.164:2222
93.148.241.179:2222
94.176.40.234:443
94.59.236.155:995
95.56.177.11:995
96.21.251.127:2222
96.241.66.126:443
96.40.175.33:443
98.115.243.237:443
98.16.204.189:995
98.30.44.223:2222
102.185.242.27:443
103.26.221.230:2222
105.198.236.101:443
108.23.22.28:0
109.115.125.81:50000
109.93.245.93:995
111.95.212.237:2222
118.70.55.146:443
121.50.153.66:995
125.63.101.62:443
141.193.83.107:443
146.199.132.233:2222
151.27.89.199:443
151.61.107.248:2222
156.205.103.107:995
160.3.184.253:443
164.155.230.98:443
172.78.30.215:443
173.18.126.193:2222
174.104.31.209:443
174.55.197.4:443
175.137.119.141:443
176.58.133.136:2222
178.87.29.72:443
181.208.249.141:443
184.21.136.237:995
185.105.131.233:443
185.246.9.69:995
187.145.100.209:443
187.192.151.3:443
188.121.219.88:2222
188.50.187.45:995
189.132.16.126:443
189.157.3.12:443
189.231.3.63:443
190.128.215.174:443
190.85.91.154:443
196.151.252.84:443
197.161.154.132:443
197.45.110.165:995
199.116.241.147:443
200.140.154.174:2222
202.141.244.118:993
205.178.7.90:443
208.99.100.129:443
216.201.162.158:443
217.162.149.212:443
219.255.28.241:443