SYMBOLCOMMON_NAMEaka. SYNONYMS
win.qadars (Back to overview)

Qadars


There is no description at this point.

References
2021-09-03Trend MicroMohamad Mokbel
@techreport{mokbel:20210903:state:df86499, author = {Mohamad Mokbel}, title = {{The State of SSL/TLS Certificate Usage in Malware C&C Communications}}, date = {2021-09-03}, institution = {Trend Micro}, url = {https://www.trendmicro.com/content/dam/trendmicro/global/en/research/21/i/ssl-tls-technical-brief/ssl-tls-technical-brief.pdf}, language = {English}, urldate = {2021-09-19} } The State of SSL/TLS Certificate Usage in Malware C&C Communications
AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
2017-02-22PhishLabsRaashid Bhat
@online{bhat:20170222:dissecting:8124914, author = {Raashid Bhat}, title = {{Dissecting the Qadars Banking Trojan}}, date = {2017-02-22}, organization = {PhishLabs}, url = {https://info.phishlabs.com/blog/dissecting-the-qadars-banking-trojan}, language = {English}, urldate = {2019-12-20} } Dissecting the Qadars Banking Trojan
Qadars
2016-09-20SecurityIntelligenceLimor Kessem, Hanan Natan, Denis Laskov
@online{kessem:20160920:meanwhile:7b7a093, author = {Limor Kessem and Hanan Natan and Denis Laskov}, title = {{Meanwhile in Britain, Qadars v3 Hardens Evasion, Targets 18 UK Banks}}, date = {2016-09-20}, organization = {SecurityIntelligence}, url = {https://securityintelligence.com/meanwhile-britain-qadars-v3-hardens-evasion-targets-18-uk-banks/}, language = {English}, urldate = {2019-12-17} } Meanwhile in Britain, Qadars v3 Hardens Evasion, Targets 18 UK Banks
Qadars
2016-04-12Johannes Bader
@online{bader:20160412:dga:469d85e, author = {Johannes Bader}, title = {{The DGA of Qadars v3}}, date = {2016-04-12}, url = {https://www.johannesbader.ch/2016/04/the-dga-of-qadars/}, language = {English}, urldate = {2019-07-11} } The DGA of Qadars v3
Qadars
2015-07-23SecurityIntelligenceIgor Aronov
@online{aronov:20150723:analysis:0162f34, author = {Igor Aronov}, title = {{An Analysis of the Qadars Banking Trojan}}, date = {2015-07-23}, organization = {SecurityIntelligence}, url = {https://securityintelligence.com/an-analysis-of-the-qadars-trojan/}, language = {English}, urldate = {2020-01-10} } An Analysis of the Qadars Banking Trojan
Qadars
2013-12-18ESET ResearchJean-Ian Boutin
@online{boutin:20131218:qadars:98a9a63, author = {Jean-Ian Boutin}, title = {{Qadars – a banking Trojan with the Netherlands in its sights}}, date = {2013-12-18}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2013/12/18/qadars-a-banking-trojan-with-the-netherlands-in-its-sights/}, language = {English}, urldate = {2019-11-14} } Qadars – a banking Trojan with the Netherlands in its sights
Qadars
Yara Rules
[TLP:WHITE] win_qadars_auto (20211008 | Detects win.qadars.)
rule win_qadars_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.qadars."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.qadars"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 57 0fb6f9 8d7001 8bce 83c780 2bc8 897df0 }
            // n = 7, score = 700
            //   57                   | push                edi
            //   0fb6f9               | movzx               edi, cl
            //   8d7001               | lea                 esi, dword ptr [eax + 1]
            //   8bce                 | mov                 ecx, esi
            //   83c780               | add                 edi, -0x80
            //   2bc8                 | sub                 ecx, eax
            //   897df0               | mov                 dword ptr [ebp - 0x10], edi

        $sequence_1 = { 57 33c0 33ff 68ff0f0000 8945f8 8945fc 8885e8efffff }
            // n = 7, score = 700
            //   57                   | push                edi
            //   33c0                 | xor                 eax, eax
            //   33ff                 | xor                 edi, edi
            //   68ff0f0000           | push                0xfff
            //   8945f8               | mov                 dword ptr [ebp - 8], eax
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   8885e8efffff         | mov                 byte ptr [ebp - 0x1018], al

        $sequence_2 = { 57 33d2 33ff 8955fc 8945f8 85c0 }
            // n = 6, score = 700
            //   57                   | push                edi
            //   33d2                 | xor                 edx, edx
            //   33ff                 | xor                 edi, edi
            //   8955fc               | mov                 dword ptr [ebp - 4], edx
            //   8945f8               | mov                 dword ptr [ebp - 8], eax
            //   85c0                 | test                eax, eax

        $sequence_3 = { 57 33c0 68fe070000 50 8d8d02f8ffff 51 66898500f8ffff }
            // n = 7, score = 700
            //   57                   | push                edi
            //   33c0                 | xor                 eax, eax
            //   68fe070000           | push                0x7fe
            //   50                   | push                eax
            //   8d8d02f8ffff         | lea                 ecx, dword ptr [ebp - 0x7fe]
            //   51                   | push                ecx
            //   66898500f8ffff       | mov                 word ptr [ebp - 0x800], ax

        $sequence_4 = { 57 0fb6d0 888c15fcfeffff 8ad0 80e280 88840dfcfdffff 41 }
            // n = 7, score = 700
            //   57                   | push                edi
            //   0fb6d0               | movzx               edx, al
            //   888c15fcfeffff       | mov                 byte ptr [ebp + edx - 0x104], cl
            //   8ad0                 | mov                 dl, al
            //   80e280               | and                 dl, 0x80
            //   88840dfcfdffff       | mov                 byte ptr [ebp + ecx - 0x204], al
            //   41                   | inc                 ecx

        $sequence_5 = { 56 e8???????? 8b4508 83c408 5f 5e 5b }
            // n = 7, score = 700
            //   56                   | push                esi
            //   e8????????           |                     
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   83c408               | add                 esp, 8
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx

        $sequence_6 = { 57 0f95c0 fec8 24e0 0440 8845ff 3c20 }
            // n = 7, score = 700
            //   57                   | push                edi
            //   0f95c0               | setne               al
            //   fec8                 | dec                 al
            //   24e0                 | and                 al, 0xe0
            //   0440                 | add                 al, 0x40
            //   8845ff               | mov                 byte ptr [ebp - 1], al
            //   3c20                 | cmp                 al, 0x20

        $sequence_7 = { 56 e8???????? 83c418 e9???????? 895dcc 895ddc }
            // n = 6, score = 700
            //   56                   | push                esi
            //   e8????????           |                     
            //   83c418               | add                 esp, 0x18
            //   e9????????           |                     
            //   895dcc               | mov                 dword ptr [ebp - 0x34], ebx
            //   895ddc               | mov                 dword ptr [ebp - 0x24], ebx

        $sequence_8 = { 6a00 8d4df4 51 6a04 8d55f8 52 }
            // n = 6, score = 600
            //   6a00                 | push                0
            //   8d4df4               | lea                 ecx, dword ptr [ebp - 0xc]
            //   51                   | push                ecx
            //   6a04                 | push                4
            //   8d55f8               | lea                 edx, dword ptr [ebp - 8]
            //   52                   | push                edx

        $sequence_9 = { 6a01 6a08 ff15???????? 83c408 }
            // n = 4, score = 300
            //   6a01                 | push                1
            //   6a08                 | push                8
            //   ff15????????         |                     
            //   83c408               | add                 esp, 8

        $sequence_10 = { 83c40c 6805010000 8d8df8feffff 51 }
            // n = 4, score = 300
            //   83c40c               | add                 esp, 0xc
            //   6805010000           | push                0x105
            //   8d8df8feffff         | lea                 ecx, dword ptr [ebp - 0x108]
            //   51                   | push                ecx

        $sequence_11 = { 51 8b55f0 52 ff15???????? 83c40c }
            // n = 5, score = 300
            //   51                   | push                ecx
            //   8b55f0               | mov                 edx, dword ptr [ebp - 0x10]
            //   52                   | push                edx
            //   ff15????????         |                     
            //   83c40c               | add                 esp, 0xc

        $sequence_12 = { 6a01 8b55fc 52 ff15???????? 83c408 }
            // n = 5, score = 300
            //   6a01                 | push                1
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   52                   | push                edx
            //   ff15????????         |                     
            //   83c408               | add                 esp, 8

        $sequence_13 = { 83c404 c78518f8ffff00000000 33c9 75d9 }
            // n = 4, score = 100
            //   83c404               | add                 esp, 4
            //   c78518f8ffff00000000     | mov    dword ptr [ebp - 0x7e8], 0
            //   33c9                 | xor                 ecx, ecx
            //   75d9                 | jne                 0xffffffdb

        $sequence_14 = { 83c404 c78530c4ffff00000000 33c0 75d9 }
            // n = 4, score = 100
            //   83c404               | add                 esp, 4
            //   c78530c4ffff00000000     | mov    dword ptr [ebp - 0x3bd0], 0
            //   33c0                 | xor                 eax, eax
            //   75d9                 | jne                 0xffffffdb

        $sequence_15 = { 83c404 c745fc00000000 33d2 75e2 33c0 eb0b 8b4510 }
            // n = 7, score = 100
            //   83c404               | add                 esp, 4
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   33d2                 | xor                 edx, edx
            //   75e2                 | jne                 0xffffffe4
            //   33c0                 | xor                 eax, eax
            //   eb0b                 | jmp                 0xd
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]

    condition:
        7 of them and filesize < 630784
}
Download all Yara Rules