{
  "timestamp": "2025-02-05T23:03:17.613324",
  "content": "Search Free Trial Get Demo Email Hijacking Delivers Qakbot Malware August 4, 2022 Introduction Originally a banking Trojan that existed in the wild as early as 2007, Qakbot or QBot is a pioneer of malware as a service, which is continually maintained and developed to this day. While its main purpose is to steal banking credentials such as logins and passwords, it has also added functionalities to spy on financial operations, spread itself and install ransomware in compromised organizations to maximize revenue for cybercriminals. Email Hijacking Recently we have observed the following malware campaign exhibiting a man-in-the-middle MITM attack known as email hijacking, where malicious replies are inserted between existing legitimate email conversations. This kind of attack is commonly executed through compromised email accounts of users, who are most probably also infected with Qakbot. Figure 1. Qakbot malware infection chain Figure 2. Hijacked email thread Figure 3. Hijacked email reply The hijacked email message includes a link to a file, which looks related to alleged attachments discussed in the email conversation. To further lure the reader into clicking on the malicious download link, the threat actor purposefully saves the malicious payload in a password-protected ZIP file and mentions the password in the email message. The malicious link redirects the user to download a password-protected ZIP file that contains a malicious Windows Shortcut file LNK. Figure 4. Malicious LNK commands Once the downloaded ZIP file is extracted using the password provided in the email, and the contained Windows Shortcut file is executed, a JavaScript payload is downloaded and executed via wscript. the Qakbot DLL payload and execute it via regsvr32, the new variant makes use of JavaScript as an additional layer of execution, preventing security solutions from immediately detecting the final payload. The downloaded JavaScript payload is heavily obfuscated, making code analysis difficult. It includes obfuscation that hinders debuggers such as Visual Studio Code and browser source debuggers Chrome, Edge, and Firefox, causing them to raise exceptions that prevent the malware from running properly when debugged. Figure 5. Heavily obfuscated Qakbot javascript code Fortunately, we have an internal tool known as CyrenSE Cyren Script Emulator, which can emulate the obfuscated JavaScript malware and log script execution events, giving us a clearer view of the malicious behavior, as shown in the examples below. Figure 6. CyrenSE event log In this case, the JavaScript payload appears to have been included as an additional layer in the infection chain before downloading and executing the Qakbot payload which is usually delivered as executable Windows DLLs loaded via regsvr32. Unfortunately, the download links to the final malware payload are no longer accessible. The demonstrated infection chain shows a clear relation to previous Qakbot campaigns and may eventually lead to further delivery of ransomware to the intended targets. Recommendations As threat actors have become more sophisticated in the attack methods they use, implementing comprehensive email and network security has become essential for protecting your company from reputational damage, brand damage, data loss, and more. Cyren Inbox Security uses elaborate logic and remediation rules to protect its users effectively and without excess noise. Cyrens anti-phishing software solutions are designed with todays cybercrime concerns in mind. They utilize advanced anti-phishing technology to pick up and contain the most complex phishing tactics, protecting over a billion users against emerging threats. Indicators of Compromise Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Example Analysis of Multi-Component Malware Protect Office 365 Email from Ransomware Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "product",
  "analysis": "**Cyren Security Solution Overview: Understanding Key Features and Functionality**\n\n1. **Key Security Features and Capabilities**:\n   - **CyrenSE (Script Emulator)**: This tool emulates JavaScript to detect malware by executing scripts in a controlled environment, revealing malicious intent without actual execution. It helps identify obfuscated code by observing behavior.\n   - **Email Filtering and Threat Detection**: Blocks malicious emails before delivery, using advanced methods to detect threats, including phishing attempts.\n   - **Incident Response Tools**: Facilitate quick action against detected threats, potentially automating responses like quarantining emails.\n\n2. **User Benefits and Protection Measures**:\n   - **Real-Time Analysis and Protection**: Detects both known and unknown threats, such as zero-day attacks, ensuring timely protection.\n   - **Reduced False Positives**: Minimizes unnecessary alerts, allowing users to focus on genuine threats.\n\n3. **Integration with Existing Systems**:\n   - **Email Services Integration**: Works with Office 365, Exchange, etc., enhancing existing email security.\n   - **SIEM and SOAR Integration**: Integrates with platforms like Splunk via logs/APIs, and with SOAR (Security Orchestration, Automation, Response) for automated workflows, enhancing security operations.\n\n4. **Compliance and Certification**:\n   - **Regulatory Compliance**: Adheres to GDPR, CCPA, and HIPAA, ensuring data protection through practices like encryption and secure data handling.\n   - **Certifications**: Recognized by VB Bulletin and AV-Test for efficacy in threat detection and response.\n\n5. **Security Best Practices**:\n   - **User Training and Awareness**: Educates users to recognize phishing attempts.\n   - **Email Client Settings**: Advises configuring settings to enhance security.\n   - **Regular Updates**: Ensures protection against the latest threats.\n\n6. **Technical Specifications**:\n   - **Machine Learning Usage**: Employs algorithms for pattern recognition and behavior analysis to detect evolving threats.\n   - **Compatibility**: Functions in cloud and on-prem environments, accessible via web and mobile.\n\n**Conclusion**: Cyren offers a comprehensive security solution that integrates seamlessly with existing systems, leveraging advanced technologies like script emulation and machine learning to protect against threats like Qakbot. Its focus on compliance, automation, and user education ensures robust protection and ease of use."
}