www.menlosecurity.com Open in urlscan Pro
141.193.213.21 Public Scan

Back to summary

Submitted URL:
https://pages.menlosecurity.com/MjgxLU9XVi04OTkAAAGHJcwDv0lqJMzqQx05X36gV2XFycDiMP5l0H0UWpMuy0TY0VPkXI1JR9xvcR0aIyRwaJ0h1VU=
Effective URL:
https://www.menlosecurity.com/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022...
Submission: On September 29 via api (September 29th 2022, 2:20:07 am UTC) from SG — Scanned from DE

Form analysis
6 forms found in the DOM

GET https://www.menlosecurity.com/

<form action="https://www.menlosecurity.com/" class="search-form" method="get" role="search"> <label> <span class="screen-reader-text">Search for:</span> <input type="text" title="Search for:" name="s" value="" id="s" placeholder="Search …"
      class="search__field" autocomplete="off"> </label> <button type="submit" class="search__btn"> Search <i class="fas fa-search"></i> </button></form>

GET https://www.menlosecurity.com/

<form action="https://www.menlosecurity.com/" class="search-form" method="get" role="search"> <label> <span class="screen-reader-text">Search for:</span> <input type="text" title="Search for:" name="s" value="" id="s" placeholder="Search …"
      class="search__field" autocomplete="off"> </label> <button type="submit" class="search__btn"> Search <i class="fas fa-search"></i> </button></form>

POST /blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3

<form method="post" enctype="multipart/form-data" target="gform_ajax_frame_1" id="gform_1" class="subscribe"
  action="/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&amp;utm_medium=email&amp;utm_source=outboundemail&amp;mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3"
  novalidate="">
  <div class="gform_body gform-body">
    <div id="gform_fields_1" class="gform_fields top_label form_sublabel_below description_below">
      <div id="field_1_1" class="gfield gfield_contains_required field_sublabel_below field_description_below hidden_label gfield_visibility_visible gfield--email gfield--large" data-field-class="gfield--email gfield--large"><label
          class="gfield_label" for="input_1_1">Email<span class="gfield_required"><span class="gfield_required gfield_required_text">(Required)</span></span></label>
        <div class="ginput_container ginput_container_email"> <input name="input_1" id="input_1_1" type="email" value="" class="large" tabindex="1" placeholder="Email" aria-required="true" aria-invalid="false"></div>
      </div>
      <div id="field_1_2" class="gfield gform_validation_container field_sublabel_below field_description_below gfield_visibility_visible gfield--honeypot gfield--" data-field-class="gfield--honeypot gfield--"><label class="gfield_label"
          for="input_1_2">Email</label>
        <div class="ginput_container"><input name="input_2" id="input_1_2" type="text" value="" autocomplete="new-password"></div>
        <div class="gfield_description" id="gfield_description_1_2">This field is for validation purposes and should be left unchanged.</div>
      </div>
    </div>
  </div>
  <div class="gform_footer top_label"> <input type="submit" id="gform_submit_button_1" class="gform_button button" value="Subscribe" tabindex="2"
      onclick="if(window[&quot;gf_submitting_1&quot;]){return false;}  if( !jQuery(&quot;#gform_1&quot;)[0].checkValidity || jQuery(&quot;#gform_1&quot;)[0].checkValidity()){window[&quot;gf_submitting_1&quot;]=true;}  "
      onkeypress="if( event.keyCode == 13 ){ if(window[&quot;gf_submitting_1&quot;]){return false;} if( !jQuery(&quot;#gform_1&quot;)[0].checkValidity || jQuery(&quot;#gform_1&quot;)[0].checkValidity()){window[&quot;gf_submitting_1&quot;]=true;}  jQuery(&quot;#gform_1&quot;).trigger(&quot;submit&quot;,[true]); }">
    <input type="hidden" name="gform_ajax" value="form_id=1&amp;title=&amp;description=&amp;tabindex=1"> <input type="hidden" class="gform_hidden" name="is_submit_1" value="1"> <input type="hidden" class="gform_hidden" name="gform_submit" value="1">
    <input type="hidden" class="gform_hidden" name="gform_unique_id" value=""> <input type="hidden" class="gform_hidden" name="state_1" value="WyJbXSIsIjFlNGM1ZWU3MWRjMWEyYzRmZjZlY2YwYjIxZGNhZGQ0Il0="> <input type="hidden" class="gform_hidden"
      name="gform_target_page_number_1" id="gform_target_page_number_1" value="0"> <input type="hidden" class="gform_hidden" name="gform_source_page_number_1" id="gform_source_page_number_1" value="1"> <input type="hidden" name="gform_field_values"
      value=""></div>
</form>

<form id="mktoForm_2571" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); width: 3201px;">
  <style type="text/css"></style>
  <div class="mktoFormRow"><input type="hidden" name="UTM_Campaign__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="UTM_Content__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="UTM_Medium__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="UTM_Source__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="UTM_Term__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="contactUsType" id="LblcontactUsType" class="mktoLabel mktoHasWidth" style="width: 100px;">
          <div class="mktoAsterix">*</div>Contact Us Type:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><select id="contactUsType" name="contactUsType" aria-labelledby="LblcontactUsType InstructcontactUsType" class="mktoField mktoHasWidth mktoRequired" aria-required="true"
          style="width: 150px;">
          <option value="">Contacting about...</option>
          <option value="Sales">Sales/Demo/Pricing</option>
          <option value="Partnership">Partnership/Channel</option>
          <option value="Others">Others</option>
        </select><span id="InstructcontactUsType" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 100px;">
          <div class="mktoAsterix">*</div>Email Address:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Email Address" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
          class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="FirstName" id="LblFirstName" class="mktoLabel mktoHasWidth" style="width: 100px;">
          <div class="mktoAsterix">*</div>First Name:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="FirstName" name="FirstName" placeholder="First Name" maxlength="255" aria-labelledby="LblFirstName InstructFirstName" type="text"
          class="mktoField mktoTextField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;"><span id="InstructFirstName" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="LastName" id="LblLastName" class="mktoLabel mktoHasWidth" style="width: 100px;">
          <div class="mktoAsterix">*</div>Last Name:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="LastName" name="LastName" placeholder="Last Name" maxlength="255" aria-labelledby="LblLastName InstructLastName" type="text"
          class="mktoField mktoTextField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;"><span id="InstructLastName" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Company" id="LblCompany" class="mktoLabel mktoHasWidth" style="width: 100px;">
          <div class="mktoAsterix">*</div>Company Name:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Company" name="Company" placeholder="Company Name" maxlength="255" aria-labelledby="LblCompany InstructCompany" type="text"
          class="mktoField mktoTextField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;"><span id="InstructCompany" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Phone" id="LblPhone" class="mktoLabel mktoHasWidth" style="width: 100px;">
          <div class="mktoAsterix">*</div>Phone Number:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Phone" name="Phone" placeholder="Phone Number" maxlength="255" aria-labelledby="LblPhone InstructPhone" type="tel"
          class="mktoField mktoTelField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;"><span id="InstructPhone" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Title" id="LblTitle" class="mktoLabel mktoHasWidth" style="width: 100px;">
          <div class="mktoAsterix">*</div>Job Title:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Title" name="Title" placeholder="Job Title" maxlength="255" aria-labelledby="LblTitle InstructTitle" type="text"
          class="mktoField mktoTextField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;"><span id="InstructTitle" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Country" id="LblCountry" class="mktoLabel mktoHasWidth" style="width: 100px;">
          <div class="mktoAsterix">*</div>Country:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><select id="Country" name="Country" aria-labelledby="LblCountry InstructCountry" class="mktoField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;">
          <option value="">Select Country ...</option>
          <option value="United States">United States </option>
          <option value="Canada">Canada </option>
          <option value="Afghanistan">Afghanistan</option>
          <option value="Aland Islands">Aland Islands</option>
          <option value="Albania">Albania</option>
          <option value="Algeria">Algeria</option>
          <option value="Andorra">Andorra</option>
          <option value="Angola">Angola</option>
          <option value="Anguilla">Anguilla</option>
          <option value="Antarctica">Antarctica</option>
          <option value="Antigua and Barbuda">Antigua and Barbuda</option>
          <option value="Argentina">Argentina</option>
          <option value="Armenia">Armenia</option>
          <option value="Aruba">Aruba</option>
          <option value="Australia">Australia</option>
          <option value="Austria">Austria</option>
          <option value="Azerbaijan">Azerbaijan</option>
          <option value="Bahamas">Bahamas</option>
          <option value="Bahrain">Bahrain</option>
          <option value="Bangladesh">Bangladesh</option>
          <option value="Barbados">Barbados</option>
          <option value="Belarus">Belarus</option>
          <option value="Belgium">Belgium</option>
          <option value="Belize">Belize</option>
          <option value="Benin">Benin</option>
          <option value="Bermuda">Bermuda</option>
          <option value="Bhutan">Bhutan</option>
          <option value="Bolivia, Plurinational State of">Bolivia, Plurinational State of</option>
          <option value="Bonaire, Sint Eustatius and Saba">Bonaire, Sint Eustatius and Saba</option>
          <option value="Bosnia and Herzegovina">Bosnia and Herzegovina</option>
          <option value="Botswana">Botswana</option>
          <option value="Bouvet Island">Bouvet Island</option>
          <option value="Brazil">Brazil</option>
          <option value="British Indian Ocean Territory">British Indian Ocean Territory</option>
          <option value="Brunei Darussalam">Brunei Darussalam</option>
          <option value="Bulgaria">Bulgaria</option>
          <option value="Burkina Faso">Burkina Faso</option>
          <option value="Burundi">Burundi</option>
          <option value="Cambodia">Cambodia</option>
          <option value="Cameroon">Cameroon</option>
          <option value="Cape Verde">Cape Verde</option>
          <option value="Cayman Islands">Cayman Islands</option>
          <option value="Central African Republic">Central African Republic</option>
          <option value="Chad">Chad</option>
          <option value="Chile">Chile</option>
          <option value="China">China</option>
          <option value="Christmas Island">Christmas Island</option>
          <option value="Cocos (Keeling) Islands">Cocos (Keeling) Islands</option>
          <option value="Colombia">Colombia</option>
          <option value="Comoros">Comoros</option>
          <option value="Congo">Congo</option>
          <option value="Congo, the Democratic Republic of the">Congo, the Democratic Republic of the</option>
          <option value="Cook Islands">Cook Islands</option>
          <option value="Costa Rica">Costa Rica</option>
          <option value="Cote d'Ivoire">Cote d'Ivoire</option>
          <option value="Croatia">Croatia</option>
          <option value="Cuba">Cuba</option>
          <option value="Curaçao">Curaçao</option>
          <option value="Cyprus">Cyprus</option>
          <option value="Czech Republic">Czech Republic</option>
          <option value="Denmark">Denmark</option>
          <option value="Djibouti">Djibouti</option>
          <option value="Dominica">Dominica</option>
          <option value="Dominican Republic">Dominican Republic</option>
          <option value="Ecuador">Ecuador</option>
          <option value="Egypt">Egypt</option>
          <option value="El Salvador">El Salvador</option>
          <option value="Equatorial Guinea">Equatorial Guinea</option>
          <option value="Eritrea">Eritrea</option>
          <option value="Estonia">Estonia</option>
          <option value="Ethiopia">Ethiopia</option>
          <option value="Falkland Islands (Malvinas)">Falkland Islands (Malvinas)</option>
          <option value="Faroe Islands">Faroe Islands</option>
          <option value="Fiji">Fiji</option>
          <option value="Finland">Finland</option>
          <option value="France">France</option>
          <option value="French Guiana">French Guiana</option>
          <option value="French Polynesia">French Polynesia</option>
          <option value="French Southern Territories">French Southern Territories</option>
          <option value="Gabon">Gabon</option>
          <option value="Gambia">Gambia</option>
          <option value="Georgia">Georgia</option>
          <option value="Germany">Germany</option>
          <option value="Ghana">Ghana</option>
          <option value="Gibraltar">Gibraltar</option>
          <option value="Greece">Greece</option>
          <option value="Greenland">Greenland</option>
          <option value="Grenada">Grenada</option>
          <option value="Guadeloupe">Guadeloupe</option>
          <option value="Guatemala">Guatemala</option>
          <option value="Guernsey">Guernsey</option>
          <option value="Guinea">Guinea</option>
          <option value="Guinea-Bissau">Guinea-Bissau</option>
          <option value="Guyana">Guyana</option>
          <option value="Haiti">Haiti</option>
          <option value="Heard Island and McDonald Islands">Heard Island and McDonald Islands</option>
          <option value="Holy See (Vatican City State)">Holy See (Vatican City State)</option>
          <option value="Honduras">Honduras</option>
          <option value="Hungary">Hungary</option>
          <option value="Iceland">Iceland</option>
          <option value="India">India</option>
          <option value="Indonesia">Indonesia</option>
          <option value="Iran, Islamic Republic of">Iran, Islamic Republic of</option>
          <option value="Iraq">Iraq</option>
          <option value="Ireland">Ireland</option>
          <option value="Isle of Man">Isle of Man</option>
          <option value="Israel">Israel</option>
          <option value="Italy">Italy</option>
          <option value="Jamaica">Jamaica</option>
          <option value="Japan">Japan</option>
          <option value="Jersey">Jersey</option>
          <option value="Jordan">Jordan</option>
          <option value="Kazakhstan">Kazakhstan</option>
          <option value="Kenya">Kenya</option>
          <option value="Kiribati">Kiribati</option>
          <option value="Korea, Democratic People's Republic of">Korea, Democratic People's Republic of</option>
          <option value="Korea, Republic of">Korea, Republic of</option>
          <option value="Kuwait">Kuwait</option>
          <option value="Kyrgyzstan">Kyrgyzstan</option>
          <option value="Lao People's Democratic Republic">Lao People's Democratic Republic</option>
          <option value="Latvia">Latvia</option>
          <option value="Lebanon">Lebanon</option>
          <option value="Lesotho">Lesotho</option>
          <option value="Liberia">Liberia</option>
          <option value="Libya">Libya</option>
          <option value="Liechtenstein">Liechtenstein</option>
          <option value="Lithuania">Lithuania</option>
          <option value="Luxembourg">Luxembourg</option>
          <option value="Macao">Macao</option>
          <option value="Macedonia, the former Yugoslav Republic of">Macedonia, the former Yugoslav Republic of</option>
          <option value="Madagascar">Madagascar</option>
          <option value="Malawi">Malawi</option>
          <option value="Malaysia">Malaysia</option>
          <option value="Maldives">Maldives</option>
          <option value="Mali">Mali</option>
          <option value="Malta">Malta</option>
          <option value="Martinique">Martinique</option>
          <option value="Mauritania">Mauritania</option>
          <option value="Mauritius">Mauritius</option>
          <option value="Mayotte">Mayotte</option>
          <option value="Mexico">Mexico</option>
          <option value="Moldova, Republic of">Moldova, Republic of</option>
          <option value="Monaco">Monaco</option>
          <option value="Mongolia">Mongolia</option>
          <option value="Montenegro">Montenegro</option>
          <option value="Montserrat">Montserrat</option>
          <option value="Morocco">Morocco</option>
          <option value="Mozambique">Mozambique</option>
          <option value="Myanmar">Myanmar</option>
          <option value="Namibia">Namibia</option>
          <option value="Nauru">Nauru</option>
          <option value="Nepal">Nepal</option>
          <option value="Netherlands">Netherlands</option>
          <option value="New Caledonia">New Caledonia</option>
          <option value="New Zealand">New Zealand</option>
          <option value="Nicaragua">Nicaragua</option>
          <option value="Niger">Niger</option>
          <option value="Nigeria">Nigeria</option>
          <option value="Niue">Niue</option>
          <option value="Norfolk Island">Norfolk Island</option>
          <option value="Norway">Norway</option>
          <option value="Oman">Oman</option>
          <option value="Pakistan">Pakistan</option>
          <option value="Palestine">Palestine</option>
          <option value="Panama">Panama</option>
          <option value="Papua New Guinea">Papua New Guinea</option>
          <option value="Paraguay">Paraguay</option>
          <option value="Peru">Peru</option>
          <option value="Philippines">Philippines</option>
          <option value="Pitcairn">Pitcairn</option>
          <option value="Poland">Poland</option>
          <option value="Portugal">Portugal</option>
          <option value="Qatar">Qatar</option>
          <option value="Reunion">Reunion</option>
          <option value="Romania">Romania</option>
          <option value="Russian Federation">Russian Federation</option>
          <option value="Rwanda">Rwanda</option>
          <option value="Saint Barthélemy">Saint Barthélemy</option>
          <option value="Saint Helena, Ascension and Tristan da Cunha">Saint Helena, Ascension and Tristan da Cunha</option>
          <option value="Saint Kitts and Nevis">Saint Kitts and Nevis</option>
          <option value="Saint Lucia">Saint Lucia</option>
          <option value="Saint Martin (French part)">Saint Martin (French part)</option>
          <option value="Saint Pierre and Miquelon">Saint Pierre and Miquelon</option>
          <option value="Saint Vincent and the Grenadines">Saint Vincent and the Grenadines</option>
          <option value="Samoa">Samoa</option>
          <option value="San Marino">San Marino</option>
          <option value="Sao Tome and Principe">Sao Tome and Principe</option>
          <option value="Saudi Arabia">Saudi Arabia</option>
          <option value="Senegal">Senegal</option>
          <option value="Serbia">Serbia</option>
          <option value="Seychelles">Seychelles</option>
          <option value="Sierra Leone">Sierra Leone</option>
          <option value="Singapore">Singapore</option>
          <option value="Sint Maarten (Dutch part)">Sint Maarten (Dutch part)</option>
          <option value="Slovakia">Slovakia</option>
          <option value="Slovenia">Slovenia</option>
          <option value="Solomon Islands">Solomon Islands</option>
          <option value="Somalia">Somalia</option>
          <option value="South Africa">South Africa</option>
          <option value="South Georgia and the South Sandwich Islands">South Georgia and the South Sandwich Islands</option>
          <option value="South Sudan">South Sudan</option>
          <option value="Spain">Spain</option>
          <option value="Sri Lanka">Sri Lanka</option>
          <option value="Sudan">Sudan</option>
          <option value="Suriname">Suriname</option>
          <option value="Svalbard and Jan Mayen">Svalbard and Jan Mayen</option>
          <option value="Swaziland">Swaziland</option>
          <option value="Sweden">Sweden</option>
          <option value="Switzerland">Switzerland</option>
          <option value="Syrian Arab Republic">Syrian Arab Republic</option>
          <option value="Taiwan">Taiwan</option>
          <option value="Tajikistan">Tajikistan</option>
          <option value="Tanzania, United Republic of">Tanzania, United Republic of</option>
          <option value="Thailand">Thailand</option>
          <option value="Timor-Leste">Timor-Leste</option>
          <option value="Togo">Togo</option>
          <option value="Tokelau">Tokelau</option>
          <option value="Tonga">Tonga</option>
          <option value="Trinidad and Tobago">Trinidad and Tobago</option>
          <option value="Tunisia">Tunisia</option>
          <option value="Turkey">Turkey</option>
          <option value="Turkmenistan">Turkmenistan</option>
          <option value="Turks and Caicos Islands">Turks and Caicos Islands</option>
          <option value="Tuvalu">Tuvalu</option>
          <option value="Uganda">Uganda</option>
          <option value="Ukraine">Ukraine</option>
          <option value="United Arab Emirates">United Arab Emirates</option>
          <option value="United Kingdom">United Kingdom</option>
          <option value="Uruguay">Uruguay</option>
          <option value="Uzbekistan">Uzbekistan</option>
          <option value="Vanuatu">Vanuatu</option>
          <option value="Venezuela, Bolivarian Republic of">Venezuela, Bolivarian Republic of</option>
          <option value="Viet Nam">Viet Nam</option>
          <option value="Virgin Islands, British">Virgin Islands, British</option>
          <option value="Wallis and Futuna">Wallis and Futuna</option>
          <option value="Western Sahara">Western Sahara</option>
          <option value="Yemen">Yemen</option>
          <option value="Zambia">Zambia</option>
          <option value="Zimbabwe">Zimbabwe</option>
        </select><span id="InstructCountry" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow">
    <div class="mktoPlaceholder mktoPlaceholderState"></div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap"><label for="MktoPersonNotes" id="LblMktoPersonNotes" class="mktoLabel mktoHasWidth" style="width: 100px;">
          <div class="mktoAsterix">*</div>Person Notes:
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><textarea id="MktoPersonNotes" name="MktoPersonNotes" rows="2" aria-labelledby="LblMktoPersonNotes InstructMktoPersonNotes" class="mktoField mktoHasWidth" maxlength="32000"
          style="width: 150px;"></textarea><span id="InstructMktoPersonNotes" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Contact Us</button></span></div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor"
    value="2571"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="281-OWV-899">
</form>

POST /blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3

<form method="post" enctype="multipart/form-data" target="gform_ajax_frame_1" id="gform_1" class="subscribe"
  action="/blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&amp;utm_medium=email&amp;utm_source=outboundemail&amp;mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3"
  novalidate="">
  <div class="gform_body gform-body">
    <div id="gform_fields_1" class="gform_fields top_label form_sublabel_below description_below">
      <div id="field_1_1" class="gfield gfield_contains_required field_sublabel_below field_description_below hidden_label gfield_visibility_visible gfield--email gfield--large" data-field-class="gfield--email gfield--large"><label
          class="gfield_label" for="input_1_1">Email<span class="gfield_required"><span class="gfield_required gfield_required_text">(Required)</span></span></label>
        <div class="ginput_container ginput_container_email"> <input name="input_1" id="input_1_1" type="email" value="" class="large" tabindex="501" placeholder="Email" aria-required="true" aria-invalid="false"></div>
      </div>
      <div id="field_1_2" class="gfield gform_validation_container field_sublabel_below field_description_below gfield_visibility_visible gfield--honeypot gfield--" data-field-class="gfield--honeypot gfield--"><label class="gfield_label"
          for="input_1_2">Phone</label>
        <div class="ginput_container"><input name="input_2" id="input_1_2" type="text" value="" autocomplete="new-password"></div>
        <div class="gfield_description" id="gfield_description_1_2">This field is for validation purposes and should be left unchanged.</div>
      </div>
    </div>
  </div>
  <div class="gform_footer top_label"> <input type="submit" id="gform_submit_button_1" class="gform_button button" value="Subscribe" tabindex="502"
      onclick="if(window[&quot;gf_submitting_1&quot;]){return false;}  if( !jQuery(&quot;#gform_1&quot;)[0].checkValidity || jQuery(&quot;#gform_1&quot;)[0].checkValidity()){window[&quot;gf_submitting_1&quot;]=true;}  "
      onkeypress="if( event.keyCode == 13 ){ if(window[&quot;gf_submitting_1&quot;]){return false;} if( !jQuery(&quot;#gform_1&quot;)[0].checkValidity || jQuery(&quot;#gform_1&quot;)[0].checkValidity()){window[&quot;gf_submitting_1&quot;]=true;}  jQuery(&quot;#gform_1&quot;).trigger(&quot;submit&quot;,[true]); }">
    <input type="hidden" name="gform_ajax" value="form_id=1&amp;title=&amp;description=&amp;tabindex=501"> <input type="hidden" class="gform_hidden" name="is_submit_1" value="1"> <input type="hidden" class="gform_hidden" name="gform_submit"
      value="1"> <input type="hidden" class="gform_hidden" name="gform_unique_id" value=""> <input type="hidden" class="gform_hidden" name="state_1" value="WyJbXSIsIjFlNGM1ZWU3MWRjMWEyYzRmZjZlY2YwYjIxZGNhZGQ0Il0="> <input type="hidden"
      class="gform_hidden" name="gform_target_page_number_1" id="gform_target_page_number_1" value="0"> <input type="hidden" class="gform_hidden" name="gform_source_page_number_1" id="gform_source_page_number_1" value="1"> <input type="hidden"
      name="gform_field_values" value=""></div>
</form>

<form novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form>

Text Content

Learn how hybrid work is fueling ransomware attacks and what to do about it.

Learn more
Search for: Search

Most Searched

 * Secure Web Gateway (SWG) 101: Your primer to an isolation-based approach to
   cybersecurity
 * Hiding in plain sight: New Adwind jRAT Variant Uses normal Java commands to
   mask its behavior
 * U.S. Department of Defense (DoD) leads the industry with cloud-based internet
   isolation program
 * ISOMorph Infection: In-Depth Analysis of a New HTML Smuggling Campaign
 * Increase In Drive-by Attack: SocGholish Malware Downloads

 * Why Menlo
   Back
   Why Menlo
   
   
   WHY MENLO
   
   Traditional security approaches are flawed, costly, and overwhelming for
   security teams. Menlo Security is different. It’s the simplest, most
   definitive way to secure work—making online threats irrelevant to your users
   and your business.
   
   Why Menlo
   
   eBook
   
   The Ultimate Buyer's Guide: Secure Web Gateway
   
   MOVING TO THE CLOUD
   
    * Switch from Bluecoat
    * Switch from Forcepoint
   
   WARRANTY
   
    * Stop ransomware in its tracks

 * Products
   Back
   Products
   
   
   MEET THE CLOUD-NATIVE MENLO SECURITY PLATFORM
   
   Our platform invisibly protects users wherever they go online. So threats are
   history and the alert storm is over.
   
   Explore platform
   
   Data Sheet
   
   Cloud Security Platform powered by and Isolation Core™
   
   PRODUCTS
   
    * Products Overview
    * Secure Web Gateway
    * Remote Browser Isolation
    * Email Isolation
    * CASB
    * DLP
    * Menlo Private Access
    * Cloud Firewall
    * Isolation Security Operations Center
   
   PLATFORM
   
    * Platform Overview
   
   CUSTOMER SUCCESS
   
    * Customers
    * Customer Support
    * Training & Certification
    * Report a Vulnerability

 * Solutions
   Back
   Solutions
   
   
   NEED TO IMPLEMENT SASE, ASAP?
   
   Traditional network security wasn’t built to address today’s complex
   enterprise environments. SASE fixes that problem.
   
   Learn more
   
   Solution Brief
   
   Learn how to migrate on-premise proxy to SWG
   
   SOLUTIONS
   
    * Solutions Overview
    * Eliminate phishing & ransomware
    * Seamless ransomware prevention
    * Gain visibility & control over data loss
    * Control access to SaaS applications
    * Implement Secure Access Service Edge (SASE)
    * Secure access to private applications
    * Secure Microsoft 365 & Google Workspace
    * Secure remote work
    * Mobile malware prevention
    * Virtual network separation
    * Neutralize malicious document downloads
    * Migrate on-premise proxy to Cloud SWG
    * Zero Trust Overview
   
   INDUSTRIES
   
    * US Federal
    * Finance

 * Resources
   Back
   Resources
   
   
   THREAT INTELLIGENCE IS ON TAP AT MENLO LABS
   
   Menlo Labs provides insights, expertise, context and tools to aid customers
   on their journey to connect, communicate and collaborate securely without
   compromise. The collective is made up of elite security researchers that put
   a spotlight on the threats you know and don’t know about.
   
   Learn More
   
   Live Webinars
   
   Defining your journey to SASE.
   
   RESOURCE LIBRARY
   
    * All Resources
    * White Papers
    * Data Sheets
    * Solution Briefs
    * Case Studies / Customer Stories
    * eBooks
    * Reports
    * Videos
    * Infographics
   
   EVENTS & WEBINARS
   
    * Live Events and Webinars
    * BrightTALK Channel
   
   BLOG
   
    * Blog Home
   
   MENLO LABS
   
    * Menlo Labs
   
   DEMO
   
    * Product Demo

 * About
   Back
   About
   
   
   THREAT INTELLIGENCE IS ON TAP AT MENLO LABS
   
   Menlo Labs provides insights, expertise, context and tools to aid customers
   on their journey to connect, communicate and collaborate securely without
   compromise.
   
   Learn more
   
   COMPANY
   
    * About Us
    * Management Team
    * Board of Directors
    * Investors
    * Customers
    * Partners
    * Technology Partners
    * Contact Us
   
   NEWSROOM
   
    * News
    * Press Releases
    * Blogs
   
   CAREERS
   
    * Life at Menlo
    * Job Openings

 * Demo

EN日本語한국어
 * * Support Portal
   * Report a Vulnerability
   * Training & Certification
 * 

Search for: Search

Most Searched

 * Secure Web Gateway (SWG) 101: Your primer to an isolation-based approach to
   cybersecurity
 * Hiding in plain sight: New Adwind jRAT Variant Uses normal Java commands to
   mask its behavior
 * U.S. Department of Defense (DoD) leads the industry with cloud-based internet
   isolation program
 * ISOMorph Infection: In-Depth Analysis of a New HTML Smuggling Campaign
 * Increase In Drive-by Attack: SocGholish Malware Downloads

Back to blog


AN ANATOMY OF HEAT ATTACKS USED BY QAKBOT CAMPAIGNS



Share this article

 * 
 * 
 * 
 * 


INTRODUCTION

Qakbot, also known as QBot or Pinkslipbot, is a banking Trojan that has existed
for over a decade. It was found in the wild in 2007 and since then it has been
continually maintained and developed.

Qakbot has become one of the leading banking Trojans around the globe. Its main
purpose is to steal banking credentials (e.g., logins, passwords, etc.), though
it has also acquired functionality allowing it to spy on financial operations,
spread itself, and install ransomware to maximize revenue from compromised
organizations.

The delivery vehicle of Qakbot is usually an email to the victim. This could be
either an email attachment or a link in the email. The email attachments
generally involve a document that downloads the Qakbot payload. Menlo Labs has
been seeing several such strains of Qakbot campaigns recently.

In this blog, we’re going to discuss the different Qakbot campaigns that use
various Highly Evasive Adaptive Threat (HEAT) techniques, and we’ll also explain
how the Qakbot payload works.


HEAT TECHNIQUES USED BY QAKBOT

The different HEAT techniques used in Qakbot campaigns identified by Menlo Labs
are as follows:

 * Email lure with hyperlink
 * Excel 4.0 macros
 * Follina exploit (CVE-2022-30190)
 * HTML Smuggling

We will provide examples of each of these techniques.


EMAIL LURE WITH HYPERLINK

In this campaign, a benign domain is compromised to host the malicious payload,
and the link to the payload is sent via an email. To evade existing defenses,
Qakbot used password-protected ZIP files, a known HEAT technique. Below is a
screenshot that shows the poor detection of these password-protected payloads on
VT.



The screenshot below shows the initial access method that Qakbot uses to evade
existing defenses.



The attack kill chain is as follows:

 * An email with a URL pointing to a malicious ZIP file is sent to the victims
   (hxxp[://]zigmatravels[.]lk/inmo/Main3173988897[.]zip).
 * The ZIP file is password protected (pwd – U523 md5 –
   afd1d504d88971e6f09d89e9dde8aeb8).
 * Inside the ZIP file is a link file with the ability to easily provide
   PowerShell commands or JS to execute.
 * Opening the link (md5 – 622D21C40A25F9834A03BFD5FF4710C1) file downloads the
   JS (md5 – 76cd1dfafc4d0fd89e228fe82ea721f6) file. The JS file then downloads
   the Qakbot payload.

The screenshot below shows one of the malicious .lnk download JS files.



The obfuscated JS file decrypts during runtime to download and execute payload
from C2, as shown below.




EXCEL 4.0 MACROS

In this campaign, Excel 4.0 macros were used to add commands into spreadsheet
cells and send the email attachments to the intended targets.

Below are some examples of emails with attachments using Excel 4.0 macros to
deliver Qakbot.



Email showing attachments of Excel file.



Upon opening the XLS document, the user is asked to enable the macro to execute
the Excel 4.0 macros.



These commands present in the XLS file download and execute payload from C2.




CVE-2022-30190

In this campaign, a CVE-2022-30190 vulnerability (also referred to as Follina)
was leveraged to deliver Qakbot. When executed, the document containing the
exploit calls out to an external HTML file that uses ms-msdt URL protocol to
execute PowerShell code.

Below are some examples of emails with attachments using CVE-2022-30190 to
deliver Qakbot.



The following are some examples of documents using CVE-2022-30190 (md5 –
7a91b01a037ccbfe6589161643d0a65a) to deliver Qakbot.



When we open the document, it tries to download the HTML file, which further
downloads the Qakbot payload.



HTML (md5 – ea48f95ab4f3ca3b0c687a726cb00c49)




HTML SMUGGLING

In this campaign, a specially crafted HTML attachment or web page was used to
build the malware locally behind a firewall.

Below are some examples of emails with an HTML Smuggling attachment.



In this campaign, the spam email contains an HTML file (md5-
2881945BDF1DB34216CC565FEF4501D4) that was encoded with Base64, as shown.



The “var text” function was Base64 encoded with an Adobe image and a
password-protected ZIP file “Report Jul 14 71645.zip” (md5-
5F57C9BF0923DE15046CCB14E41CE0A6 pwd – abc444) that gets constructed on
execution, as shown below.

The infection chain of the attack is shown in the following image.



The infection chain of the Qakbot attack using the HTML Smuggling technique is
as follows:

 * The victim opens the HTML email attachment.
 * The HTML file constructs the payload by decoding the Base64 format and
   displays the Adobe image and a password-protected ZIP file.
 * On extracting the ZIP file with the password, an ISO file “Report Jul 14
   71645.iso” is dropped in the victim’s machine.
 * The ISO file that contains the Qakbot payload makes its way to the victim’s
   machine.


QAKBOT PAYLOAD ANALYSIS

Next, we’ll explain the working of Qakbot payload, which uses the ISO file and
the components present inside that are responsible for the Qakbot execution.


REPORT JUL 14 71645.ISO

The ISO file downloaded from the archive contains 7533.dll, calc.exe, Report Jul
14 71645.lnk, and WindowsCodecs.dll.



The functionality and details of the file are as follows:

 * Report Jul 14 71645.lnk (md5 – 622D21C40A25F9834A03BFD5FF4710C1)
   * Shortcut file used to execute the payload
 * Calc.exe (md5 – 60B7C0FEAD45F2066E5B805A91F4F0FC)
   * Legitimate Windows 7 calculator application
 * Windows Codecs.dll (md5 – 21930ABBBB06588EDF0240CC60302143)
   * Malicious .dll used as a DLL sideload with calc.exe to run regsrv.exe and
     load 7533.dll
 * 7533.dll (md5 – 1FFFB3FDB0A4B780385CC5963FD4D40C)
   * Qakbot payload

Upon executing the ISO file, the .lnk file executes calc.exe and uses .dll
sideloading to load WindowsCodecs.dll, which then loads 7533.dll (Qakbot) using
regsrv32.exe.

To detonate the Qakbot payload, the DLL sideloading attack evasive technique is
used. Using this technique, calc.exe loads the masqueraded WindowsCodecs.dll to
load 7533.dll using regsv32.exe, as shown below.

This final payload finally injects its malicious code into the wermgr.exe.

The Qakbot payload using regsrv32.exe to load the .dll file is packed using a
runtime packer. The packer involves an XOR decryption to get the unpacked
version of Qakbot, as shown below.

The unpacked payload is a 32-bit .dll file compiled on June 21, 2022.

This unpacked binary stores the C2 and Botnet ID in the resource section RCDATA
(3C91E639 – C2, 89210AF9- Botnet ID).

It uses RC4 to decrypt its C2 and Botnet ID present in the resource section, as
shown below.

We created a Python script (shown in the Appendix) to decrypt the Botnet ID and
C2 using RC4. The binary we analyzed was using BotnetID Obama 201.




MENLO PROTECTION AGAINST QAKBOT

Customers using Menlo are protected against the initial access, thereby
preventing endpoint infection.

The Menlo Platform protects against the following HEAT techniques employed by
the Qakbot malware:


PASSWORD-PROTECTED ZIP FILES

The Menlo Platform opens all documents and archives downloaded from the Internet
in the Isolation Core™, away from the user’s endpoint device. Malware actors
commonly password protect malicious payloads to evade security defenses. If a
download is password protected, then the Menlo Platform prompts a user to enter
the password. Once the password is provided, the platform inspects the file and
ensures that it’s safe for download.


EXCEL 4.0 MACROS

The Menlo email product wraps any attachments received from outside the
organization. The wrapped attachment is then opened in the Isolation Core™,
where the document is converted to a safe version that can be viewed by the
user, while the inspection engines determine whether the file is good or bad.
Policies can also be configured to ensure that all documents downloaded from the
Internet are always viewed, or that a SAFE version of a document is downloaded
to the endpoint. Menlo’s Safedoc feature strips out all active content, thereby
ensuring that any malicious aspect is removed.


FOLLINA EXPLOIT

Follina is the name given to the exploit that takes advantage of Microsoft
Diagnostic Tools to fetch and execute remote code. The Menlo Platform opens all
documents and archives downloaded from the Internet in the Isolation Core™, away
from the user’s endpoint. The document is converted to a safe version that can
be viewed by the user, while the inspection engines determine whether the file
is good or bad. Policies can also be configured to ensure that all documents
downloaded from the Internet are always viewed, or that a SAFE version of a
document is downloaded to the endpoint. Menlo’s Safedoc feature strips out all
active content, thereby ensuring that the malicious aspect is removed.


HTML SMUGGLING

The goal of HTML Smuggling is to make use of HTML5/JavaScript features to
deliver file downloads, and it usually comes in two flavors:

 * Deliver the download via Data URLs on the client device.
 * Create a JavaScript blob with the appropriate MIME-type that results in a
   download on the client device.

While Qakbot uses HTML Smuggling via email attachments, Menlo Security has
identified many malicious campaigns using the web vector for HTML Smuggling. A
malicious payload that gets downloaded to the endpoint via HTML Smuggling evades
all network inspection, because the payload is constructed on the browser. The
Menlo Isolation Core™ has visibility into all types of JS and payloads
constructed on the browser, and thus detects and blocks these kinds of attacks
when delivered via the web vector.


CONCLUSION

In this post, we have showcased the different HEAT techniques used by Qakbot
campaigns we analyzed. Customers using the Menlo Isolation platform are
protected.


IOC

NameMd57533.dll1FFFB3FDB0A4B780385CC5963FD4D40CReport Jul 14
71645.lnk622D21C40A25F9834A03BFD5FF4710C1calc.exe60B7C0FEAD45F2066E5B805A91F4F0FCWindowsCodecs.dll21930ABBBB06588EDF0240CC60302143Report
Jul 14 71645.ZIP5F57C9BF0923DE15046CCB14E41CE0A6Report Jul 14
71645.ISO0C9164296949B72BF82EC1951AB7AC3B

C270.46.220.114:443179.111.8.52:32101208.107.221.224:443176.45.218.138:99524.158.23.166:99524.54.48.11:44389.101.97.139:44324.55.67.176:44324.139.72.117:443120.150.218.241:995174.69.215.101:44338.70.253.226:222241.228.22.180:443217.165.157.202:995172.115.177.204:2222173.21.10.71:222269.14.172.24:44347.23.89.60:993104.34.212.7:3210366.230.104.103:44381.158.239.251:2078179.158.105.44:443189.253.167.141:44324.178.196.158:2222174.80.15.101:2083187.116.126.216:32101100.38.242.113:99574.14.5.179:222240.134.246.185:995172.114.160.81:44372.252.157.93:99570.51.137.244:222282.41.63.217:443197.89.11.218:44337.34.253.233:44367.209.195.198:44367.165.206.193:99393.48.80.198:995111.125.245.116:9951.161.118.53:44376.25.142.196:443148.64.96.100:443217.128.122.65:222232.221.224.140:99547.180.172.159:44339.57.56.11:995186.90.153.162:222237.186.58.99:99586.97.10.37:44339.44.116.107:995182.191.92.203:99586.98.78.118:993117.248.109.38:2139.52.44.132:9951.161.118.53:99591.75.85.128:1194121.7.223.45:222239.41.90.210:99546.107.48.202:443190.252.242.69:443187.172.31.52:44372.252.157.93:99372.252.157.93:99047.145.130.171:44363.143.92.99:995197.92.136.122:44345.46.53.140:2222196.203.37.215:8094.59.138.43:222292.132.132.81:222239.49.48.167:995103.246.242.202:44384.241.8.23:3210394.59.15.180:222289.211.209.234:222294.36.193.176:222247.156.129.52:443201.172.20.105:2222109.12.111.14:44385.6.232.221:222296.37.113.36:9932.178.120.112:61202193.136.1.58:443103.133.11.10:995120.61.3.142:443182.52.159.24:44378.100.219.38:50010173.174.216.62:443106.51.48.188:5000167.69.166.79:222245.241.254.69:99388.240.59.52:44386.213.75.30:207824.43.99.75:443101.50.67.155:995108.56.213.219:9955.32.41.45:44339.53.139.2:99580.11.74.81:2222


MITRE ATT&CK TECHNIQUE

TacticTechnique IDTechnique NameInitial AccessT1566SpearPhishingDefense
EvasionT1027.006Html SmugglingDefense EvasionT1027Password Protected
zipExecutionT1204User ExecutionDefense EvasionT1574.002DLL Side-LoadingDefense
EvasionT1055Process InjectionCommand and ControlT1573.001RC4 Encryption


APPENDIX


QAKBOT CONFIG DECRYPTION CODE

—----------------------Config Decrptor—-----------------------------------
import hashlib
from arc4 import ARC4  
import struct
import socket, sys

key = b"\\System32\\WindowsPowerShel1\\v1.0\\powershel1.exe"
key = hashlib.sha1(key).digest()
print(key.hex())

file_res = open(sys.argv[1],"rb+") # c2 data from resource section
file_data = file_res.read()
file_res.close()
rc4 = ARC4(key)
data = rc4.decrypt(file_data)
print(data)

if len(data) > 70:
    data = data[20:]  
    out = ""
    while data:
   	 flag, ip, port = struct.unpack(">BLH",data[:7])
   	 ip = socket.inet_ntoa(struct.pack('!L', ip))
   	 data = data[7:]
   	 out += "{}:{}\n".format(ip,port)
    print(out)



OUTPUT IMAGE



Posted by Abhay Yadav on Aug 30, 2022

Email(Required)

Email

This field is for validation purposes and should be left unchanged.


Share this article

 * 
 * 
 * 
 * 


RELATED ARTICLES

Threat Trends & Research

HOW THE RECENT OKTAPUS RANSOMWARE ATTACK COULD HAVE BEEN PREVENTED



Threat Trends & Research

ISOLATION: A VACCINE FOR TEMPLATE INJECTION ATTACKS



Threat Trends & Research

TWO MINUTES ON… HEAT ATTACKS EVADING MALICIOUS LINK ANALYSIS



Threat Trends & Research

TWO MINUTES ON… HEAT ATTACKS EVADING MALICIOUS LINK ANALYSIS



Threat Trends & Research

HOW THE RECENT OKTAPUS RANSOMWARE ATTACK COULD HAVE BEEN PREVENTED



Threat Trends & Research

ISOLATION: A VACCINE FOR TEMPLATE INJECTION ATTACKS



Threat Trends & Research

TWO MINUTES ON… HEAT ATTACKS EVADING MALICIOUS LINK ANALYSIS



Threat Trends & Research

HOW THE RECENT OKTAPUS RANSOMWARE ATTACK COULD HAVE BEEN PREVENTED




See more resources


MAKE THE SECURE WAY TO WORK THE ONLY WAY TO WORK.

To talk to a Menlo Security expert, complete the form, or call us at (650)
695-0695.

Try Menlo Free
*
Contact Us Type:

Contacting about...Sales/Demo/PricingPartnership/ChannelOthers


*
Email Address:




*
First Name:



*
Last Name:




*
Company Name:



*
Phone Number:




*
Job Title:



*
Country:

Select Country ...United States Canada AfghanistanAland
IslandsAlbaniaAlgeriaAndorraAngolaAnguillaAntarcticaAntigua and
BarbudaArgentinaArmeniaArubaAustraliaAustriaAzerbaijanBahamasBahrainBangladeshBarbadosBelarusBelgiumBelizeBeninBermudaBhutanBolivia,
Plurinational State ofBonaire, Sint Eustatius and SabaBosnia and
HerzegovinaBotswanaBouvet IslandBrazilBritish Indian Ocean TerritoryBrunei
DarussalamBulgariaBurkina FasoBurundiCambodiaCameroonCape VerdeCayman
IslandsCentral African RepublicChadChileChinaChristmas IslandCocos (Keeling)
IslandsColombiaComorosCongoCongo, the Democratic Republic of theCook
IslandsCosta RicaCote d'IvoireCroatiaCubaCuraçaoCyprusCzech
RepublicDenmarkDjiboutiDominicaDominican RepublicEcuadorEgyptEl
SalvadorEquatorial GuineaEritreaEstoniaEthiopiaFalkland Islands (Malvinas)Faroe
IslandsFijiFinlandFranceFrench GuianaFrench PolynesiaFrench Southern
TerritoriesGabonGambiaGeorgiaGermanyGhanaGibraltarGreeceGreenlandGrenadaGuadeloupeGuatemalaGuernseyGuineaGuinea-BissauGuyanaHaitiHeard
Island and McDonald IslandsHoly See (Vatican City
State)HondurasHungaryIcelandIndiaIndonesiaIran, Islamic Republic
ofIraqIrelandIsle of
ManIsraelItalyJamaicaJapanJerseyJordanKazakhstanKenyaKiribatiKorea, Democratic
People's Republic ofKorea, Republic ofKuwaitKyrgyzstanLao People's Democratic
RepublicLatviaLebanonLesothoLiberiaLibyaLiechtensteinLithuaniaLuxembourgMacaoMacedonia,
the former Yugoslav Republic
ofMadagascarMalawiMalaysiaMaldivesMaliMaltaMartiniqueMauritaniaMauritiusMayotteMexicoMoldova,
Republic
ofMonacoMongoliaMontenegroMontserratMoroccoMozambiqueMyanmarNamibiaNauruNepalNetherlandsNew
CaledoniaNew ZealandNicaraguaNigerNigeriaNiueNorfolk
IslandNorwayOmanPakistanPalestinePanamaPapua New
GuineaParaguayPeruPhilippinesPitcairnPolandPortugalQatarReunionRomaniaRussian
FederationRwandaSaint BarthélemySaint Helena, Ascension and Tristan da
CunhaSaint Kitts and NevisSaint LuciaSaint Martin (French part)Saint Pierre and
MiquelonSaint Vincent and the GrenadinesSamoaSan MarinoSao Tome and
PrincipeSaudi ArabiaSenegalSerbiaSeychellesSierra LeoneSingaporeSint Maarten
(Dutch part)SlovakiaSloveniaSolomon IslandsSomaliaSouth AfricaSouth Georgia and
the South Sandwich IslandsSouth SudanSpainSri LankaSudanSurinameSvalbard and Jan
MayenSwazilandSwedenSwitzerlandSyrian Arab RepublicTaiwanTajikistanTanzania,
United Republic ofThailandTimor-LesteTogoTokelauTongaTrinidad and
TobagoTunisiaTurkeyTurkmenistanTurks and Caicos IslandsTuvaluUgandaUkraineUnited
Arab EmiratesUnited KingdomUruguayUzbekistanVanuatuVenezuela, Bolivarian
Republic ofViet NamVirgin Islands, BritishWallis and FutunaWestern
SaharaYemenZambiaZimbabwe




*
Person Notes:




Contact Us


GET THREAT INTELLIGENCE INSIGHTS FROM MENLO.

Email(Required)

Phone

This field is for validation purposes and should be left unchanged.


By clicking the subscribe button, you are agreeing to our privacy policy.

POPULAR RESOURCES

 * Why Menlo
 * Menlo Security Platform
 * Products
 * Solutions
 * Menlo Labs
 * Resources
 * Blog

COMPANY

 * About Us
 * Leadership
 * Customers
 * Technology Partners
 * Life at Menlo
 * Careers
 * Contact

SUPPORT

 * Support Portal
 * Report a Vulnerability
 * Training & Certification

© 2022 Menlo Security. All rights reserved.

 * Privacy Policy
 * Compliance
 * EULA
 * ask@menlosecurity.com
 * (650) 695-0695

 * 
 * 
 * 
 * 

EN日本語한국어

Notifications







By clicking “Accept All Cookies”, you agree to the storing of cookies on your
device to enhance site navigation, analyze site usage, and assist in our
marketing efforts.

Accept All Cookies

Cookies Settings


PRIVACY PREFERENCE CENTER




 * YOUR PRIVACY


 * FUNCTIONAL COOKIES


 * PERFORMANCE COOKIES


 * TARGETING COOKIES


 * STRICTLY NECESSARY COOKIES

YOUR PRIVACY

When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information

FUNCTIONAL COOKIES

Functional Cookies


These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then some
or all of these services may not function properly.

PERFORMANCE COOKIES

Performance Cookies


These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.

TARGETING COOKIES

Targeting Cookies


These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.

STRICTLY NECESSARY COOKIES

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to block
or alert you about these cookies, but some parts of the site will not then work.
These cookies do not store any personally identifiable information.

Back Button


BACK

Filter Button
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Clear
checkbox label label
Apply Cancel
Confirm My Choices
Allow All

www.menlosecurity.com Open in urlscan Pro 141.193.213.21 Public Scan

Form analysis 6 forms found in the DOM

GET https://www.menlosecurity.com/

GET https://www.menlosecurity.com/

POST /blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3

POST /blog/an-anatomy-of-heat-attacks-used-by-qakbot-campaigns/?utm_campaign=contentnewsletter-sep2022&utm_medium=email&utm_source=outboundemail&mkt_tok=MjgxLU9XVi04OTkAAAGHJcwDvzk4KgdF8tIm8jx2WaoFU0f1RtuvmKrLgCQLkZMzKc0Pm1MyiTRJPqht9_zi69g7UGZckoAtVq7UcnD_QUe1M_xEiRwdQW3ELx9WEuO3

Text Content

www.menlosecurity.com Open in urlscan Pro
141.193.213.21 Public Scan

Form analysis
6 forms found in the DOM