In this short article I’ll outline some analysis I performed on the QBot\/QakBot malware family with Zeek.<\/p>\n\n\n\n
I took a look at the following PCAPs from this family of malware, hoping to make it into a Zeek Roulette:<\/p>\n\n\n\n
<\/p>\n\n\n\n
You will see that in each of the malware write ups, and in the PCAPs, that the malware C2 is sent across HTTPS. That limits our ability to detect the raw C2.<\/p>\n\n\n\n
Initially, I thought I could potentially use the JA3\/JA3S hashes in Zeek to identify C2 clients and servers through their HTTPS parameters.<\/p>\n\n\n\n
I specifically looked at: https:\/\/www.malware-traffic-analysis.net\/2023\/03\/31\/index.html<\/a> and the C2, according to the notes downloaded from that link, happens over TCP 2222 and 443. The JA3 and J3S are:<\/p>\n\n\n\n 72a589da586844d7f0818ce684948eea <\/p>\n\n\n\n fd4bc6cea4877646ccd62f0792ec0b62<\/p>\n\n\n\n I took these hashes and ran them across a large live network I am able to monitor. Specifically, I searched the ssl.log over the past week on this network. I got hits with the hashes separately (as if they were OR’d) that looked like legitimate SSL traffic, so I looked for the times when the JA3 and<\/em> JA3S matched. In that case I saw a connection between a local network asset and McAfee, Inc. The probability is low that McAfee would have a C2 server, so I think this detection method may not work so well. <\/p>\n\n\n\n After finding a couple more hits that flagged connections where it looked like false positives, I don’t see how the JA3 analysis will identify this malware family.<\/p>\n\n\n\n I will continue to think on this one, but C2 like this over HTTPS is much more difficult to detect.<\/p>\n\n\n\n In this short article I’ll outline some analysis I performed on the QBot\/QakBot malware family with Zeek. I took a look at the following PCAPs from this family of malware, hoping to make it into a Zeek Roulette: You will see that in each of the malware write ups, and in the PCAPs, that the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[144,140,91,24,4,145],"tags":[141,100,273,272,271,27],"class_list":["post-2171","post","type-post","status-publish","format-standard","hentry","category-detection","category-malware","category-open-source","category-pcaps","category-zeek","category-zeek-roulette","tag-malware","tag-opensource","tag-pcap","tag-qakbot","tag-qbot","tag-zeek"],"aioseo_notices":[],"jetpack_featured_media_url":"","jetpack-related-posts":[],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/posts\/2171","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/comments?post=2171"}],"version-history":[{"count":0,"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/posts\/2171\/revisions"}],"wp:attachment":[{"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/media?parent=2171"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/categories?post=2171"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/drkeithjones.com\/index.php\/wp-json\/wp\/v2\/tags?post=2171"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Additional Reading:<\/h2>\n\n\n\n
\n