W32.Qakbot is a worm that's been around since at least 2009. The worm initially infects users by exploiting vulnerabilities when certain Web pages are visited. It subsequenly spreads through network shares and removable drives. It downloads additional files, steals information, and opens a backdoor on the compromised computer. During the past few months, we've seen high levels of active development from the malware author's side, the intent of which is to circumvent detection techniques used by various security software.
The Symantec Security Response team has been monitoring this worm for the past couple of years. Activity around Qakbot appears every couple of months when external entities claim to see an outbreak. The last major wave we saw started in early April. We took that opportunity to spend additional time to analyze and document the working of this threat in a little more detail. We took some actions to monitor the threat's prevalence and learned a lot.
Data acquired using our in-field telemetry shows us just how prevalent this worm is. In the first quarter of 2011, the worm activity wasn't very different as compared to most other active worms. Once the author seeded the newer variants, it's hard to believe if he/she could have foreseen its ability to spread.
Some of the key findings from the analysis of Qakbot were:
In one instance a few weeks ago, we also saw Qakbot files being digitally signed using a valid legitimate key. The intention behind signing the files is always to enhance appearance of legitimacy to unsuspecting end users. Although we spoke with the legitimate owners of the digital key and got it revoked, a stolen key being used by Qakbot shows how actively the controllers are seeking means to push their creations to a wider client base.
Additional statistics about how many people continue to be affected by the threat on an ongoing basis can be found with the report liked at the bottom of this article. Also within the document, one can find details of each of the aforementioned Qakbot functions.
Details about all the aforementioned Qakbot functions and additional statistics, including infection rates, can be read about in this whitepaper.