Group IB Ransomware September 2020

QakBot can use net config workstation, arp -a, `nslookup`, and ipconfig /all to gather network configuration information.

QakBot can use large file sizes to evade detection.

ProLock can use .jpg and .bmp files to store its payload.

QakBot can store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.

The QakBot payload has been disguised as a PNG file and hidden within LNK files using a Microsoft File Explorer icon.

ProLock can use WMIC to execute scripts on targeted hosts.

QakBot has the ability to create scheduled tasks for persistence.

QakBot can use PowerShell to download and execute payloads.

QakBot can use VBS to download and execute malicious files.

ProLock can use CVE-2019-0859 to escalate privileges on a compromised host.

QakBot can delete folders and files including overwriting its executable with legitimate programs.

ProLock can remove files containing its payload after they are executed.

QakBot can collect system information including the OS version and domain on a compromised host.

QakBot has the ability to download additional components and malware.

QakBot can modify the Registry to store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.

ProLock can use BITS jobs to download its malicious payload.

QakBot has gained execution through users opening malicious links.

QakBot has gained execution through users opening malicious attachments.

ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.

ProLock can use vssadmin.exe to remove volume shadow copies.

QakBot can enumerate a list of installed programs.

QakBot can maintain persistence by creating an auto-run Registry key.

QakBot has spread through emails with malicious attachments.

QakBot has spread through emails with malicious links.

QakBot has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list.