Researchers Decrypted Qakbot Banking Trojan’s Encrypted Registry Keys

Cybersecurity researchers have decoded the mechanism by which the versatile Qakbot banking trojan handles the insertion of encrypted configuration knowledge into the Home windows Registry.

Qakbot, also called QBot, QuackBot and Pinkslipbot, has been noticed within the wild since 2007. Though primarily long-established as an information-stealing malware, Qakbot has since shifted its objectives and bought new performance to ship post-compromise assault platforms comparable to Cobalt Strike Beacon, with the ultimate goal of loading ransomware on contaminated machines.

“It has been frequently developed, with new capabilities launched comparable to lateral motion, the power to exfiltrate e mail and browser knowledge, and to put in further malware,” Trustwave researchers Lloyd Macrohon and Rodel Mendrez stated in a report shared with The Hacker Information.

In current months, phishing campaigns have culminated within the distribution of a new loader known as SQUIRRELWAFFLE, which acts as a channel to retrieve final-stage payloads comparable to Cobalt Strike and QBot.

Newer variations of Qakbot have additionally gained the power to hijack e mail and browser knowledge in addition to insert encrypted configuration info pertaining to the malware into the registry versus writing them to a file on disk as a part of its makes an attempt to depart no hint of the an infection.

“Whereas QakBot shouldn’t be going totally fileless, its new ways will certainly decrease its detection,” Hornetsecurity researchers identified in December 2020.

Trustwave’s evaluation into the malware goals to reverse engineer this course of and decrypt the configuration saved within the registry key, with the cybersecurity firm noting that the important thing used to encrypt the registry key worth knowledge is derived from a mixture of pc title, quantity serial quantity, and the person account title, which is then hashed and salted together with a one-byte identifier (ID).

“The SHA1 hash end result will probably be used as a derived key to decrypt the registry key worth knowledge respective to the ID utilizing the RC4 algorithm,” the researchers stated, along with making obtainable a Python-based decryptor utility that can be utilized to extract the configuration from the registry.