Technical analysis by the Malware Hunter JAMESWT

Quakbot “signed” campaign continues to spread worldwide with new company certificates and links

Quakbot signed global campaign continues to spread. There are new malicious mails on the wild, distributed by cybercrime with same template and xls attachment, but new links. It exploits company certificates to sign the executable. Last one involves “Hairis LLC”. The objective is to decept the anti virus and let the victims download and install the malicious file through the attachment and a link. Criminal hackers for this purpose are exploiting organizations from different countries. In the last period have been used many signatures. They include those related to:

Mislean Software Limited

Master Networking s.r.o.

DocsGen Software Solutions Inc.

Digital Capital Management Ireland Limited

Equal Cash Technologies Limited

Korist Networks Incorporated

Instamix Limited

Akhirah Technologies Inc.

Bamboo Connect s.r.o.

OLIMP STROI OOO

BOREC OOO

Cubic Information Systems UAB

Highweb Ireland Operations Limited

VESNA OOO

THREE D CORPORATION PTY LTD

Umbrella LLC

Olymp LLC

Hairis LLC

The malware is a banking trojan with worm capabilites

The QuakBot (aka Qbot) malware is a modular cybercrime banking trojan known to target businesses to steal money from their online banking accounts. It features worm capabilities to self-replicate through shared drives and removable media. The code uses powerful information-stealing features to spy on users’ banking activity.

Two email samples detected by abuse_ch

The fake .xls attachment

DNS HTTP/HTTPS requests / Connection