Malware
QBOT V4 Banking Trojan: Execution Chain, Persistence, and New YARA Rule
Elastic Security Labs released a detailed analysis of QBOT V4, outlining its multi‑stage execution, dynamic persistence, and command‑and‑control mechanics. The report includes a YARA rule, a configuration extractor, and IOCs for defenders to deploy.
What Happened
QBOT, also known as QAKBOT, is a modular banking trojan that has been active since 2007. A recent campaign used the V4 core to infect Windows systems, download additional payloads, and communicate with a remote C2 infrastructure.
Execution Flow
1. Initialization – The malware is launched via regsvr32.exe, which calls the DLL’s DllRegisterServer export. It then checks for a sandbox by looking for C:\INTERNAL\__empty; if found it exits. It enumerates running processes to detect AV products, but continues execution regardless of detection.
2. Installation – QBOT injects itself into legitimate processes, sets up a dynamic persistence mechanism, and writes a service entry to maintain execution across reboots.
3. Communication – The trojan contacts a list of hard‑coded IP addresses, receives updates, uploads file‑less binaries, and can execute shell commands.
Impact
The malware can exfiltrate banking credentials, download arbitrary binaries, and execute arbitrary commands, posing a high risk to financial institutions and enterprises.
What to Do
• Deploy the provided YARA rule to detect the core DLL in memory and on disk.
• Run the configuration extractor to decrypt and review the embedded C2 IP list and payload URLs.
• Monitor regsvr32.exe activity and flag any execution that loads a DLL from an unexpected location.
• Block the identified C2 IPs and domains at the perimeter and in DNS filtering.
• Verify that the C:\INTERNAL\__empty folder is not present; its creation may indicate a sandbox check.
• Keep AV signatures up to date and monitor for the AV vendors listed in the analysis.
Related articles
RTM Group Banking Trojan Infection: Forensic Findings and Defender Actions
A forensic investigation of a workstation infected with a banking trojan distributed by the RTM group revealed credential theft, persistence, and lateral movement. Defenders should isolate affected hosts, review authentication logs, and deploy EDR signatures to mitigate future attacks.
Read briefing
Hirudo Android Trojan Replaces Banking Apps with Patched Versions to Evade Security Checks
A new Android banking trojan, Hirudo, replaces legitimate banking apps with custom patched copies that bypass in‑app integrity and signature checks. The malware, delivered via popular dropper apps, steals credentials, takes device control, and captures screens, cameras, and SMS. Defenders should audit banking app integrity, block suspicious in‑app updates, and monitor for unauthorized accessibility services.
Read briefing
Ajina.Banker Android Malware Targets Central Asia: Steals Banking Credentials and 2FA Messages
In May 2024, Group‑IB uncovered Ajina.Banker, an Android banking trojan that masquerades as legitimate apps to harvest credentials and intercept 2‑factor SMS. The malware has been active across Central Asia, compromising users of popular banking apps. Defenders should verify app provenance, enforce app whitelisting, and monitor for anomalous SMS traffic.
Read briefing
Godfather Trojan Targets Mobile Banking Apps – Immediate Mitigation Steps
Group‑IB uncovered the Godfather banking Trojan infecting users of 400+ mobile financial apps in 16 countries. The malware steals credentials and forces unauthorized transfers. Defenders must update apps, enforce MFA, and monitor transactions.
Read briefing