Geodo botnet spotted delivering Qakbot malware in new campaign

guest · Feb 8, 2019

Geodo botnet spotted delivering Qakbot malware in new campaign
February 7, 2019
https://cyware.com/news/geodo-botnet-spotted-delivering-qakbot-malware-in-new-campaign-9114fdd0

As per the firm’s report, Geodo botnet directly delivers Qakbot through phishing. In addition, the campaigns seemed to have narrowed down on targeting specific users, especially US government agencies.

“The structure of the campaign delivering Qakbot followed the typical Geodo lifecycle: a weaponized Office document containing hostile macros delivered via a phishing campaign, except the initial payload—Qakbot— was anything but typical,” indicated the report by Cofense.

The macros, if executed, will start downloading a PowerShell-based Qakbot payload.
When the payload starts infecting the system, it performs two other checks, anti-analysis and anti-sandbox, to disguise itself as a legitimate system operation.

Another noteworthy aspect of this Geodo campaign is its targeting.
Click to expand...

Log in or Sign up

Geodo botnet spotted delivering Qakbot malware in new campaign

guest Guest

Log in or Sign up

Geodo botnet spotted delivering Qakbot malware in new campaign

guest Guest

Useful Searches