<commit_before>---
layout: post
title: Quant Loader
---

Quant Loader is a piece of Russian malware that originated from exploit.in during the September of 2016. It has gained notoriety in underground circles for being a stable and reliable botnet. It is priced at $550 for the full license, quite expensive for this quality, or rather lack thereof. 

The first thing that Quant does is sleep for 180 seconds (og 100% fud reboot antivirus runtime bypass). 
![quant_sleep]({{ site.baseurl }}/images/quant_sleep.png)

It then proceeds to decrypt all the strings at once to ensure that reversing it is very easy. **URLDownloadToFileA**? Why is this "professional dll loader/dropper" using win32api functions to preform it's core task? Other interesting strings include the **":Zone.Identifier"**, presumably to strip the identifier flag when the file is downloaded off the internet. To determine whether the system is 32 bit or 64 bit, it reads the "ProgramFiles Dir (x86)". If there is an "x86" in the program files directory, it is a 64 bit system. 

The malware then generates it's unique ID by reading the MachineGuid key at *"SOFTWARE\Microsoft\Cryptography"*, reading only the numbers, then reading 8 numbers starting from the 5th. It will use this GUID to create a new folder at the **Appdata\Roaming\<Guid>\svchost.exe** path, and copying an instance of itself to the path.
![quant_guid]({{ site.baseurl }}/images/quant_guid.png)

Quant checks for a number of antiviruses by comparing registry keys, exiting if any of them are found.

* Kaspersky
  * "kis" "SOFTWARE\KasperskyLab\LicStrg"
* Panda
  * "FirewallName" "SOFTWARE\Panda Software\Setup" 
* Norton Security
  * "TaskbarGroupIcon" "SOFTWARE\CLasses\Applications\NS.exe" 
* Dr Web
  * "DisplayName" "SYSTEM\ControlSet001\services\DrWebLwf"
* Bitdefender
  * "InstallPath" "SOFTWARE\Bitdefender Agent\Install"
* Bullguard
  * "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\bullguard.exe"

It then edits the firewall to allow outbound traffic using the following command

`
netsh.exe advfirewall firewall add rule "name=Quant" "program=c:\users\appdata\<uid>\svchost.exe" dir=Out action=allow'
`

![quant_firewall]({{ site.baseurl }}/images/quant_firewall.png)

And also changes the permission of the folder and executable using a very undetected and elegant method, launching an instance of cmd.exe

`cmd.exe /c echo Y|CACLS "c:\users\<user>\appdata\roaming\<uid>\svchost.exe" /P "user:R"
cmd.exe /c echo Y|CACLS "c:\users\<user>\appdata\roaming\<uid>" /P "user:R"`


It also launches the new dropped executable using a non-resolved ShellExecuteA, before sleeping for a number of minutes. Very nice.

Then, it uses a very stealthy and undetected startup method, the runkey

`
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
`<commit_msg>Update 2017-10-20-Quant-Loader.md<commit_after>---
layout: post
title: Quant Loader
---

Quant Loader is a piece of Russian malware that originated from exploit.in during the September of 2016. It has gained notoriety in underground circles for being a stable and reliable botnet. It is priced at $550 for the full license, quite expensive for this quality, or rather lack thereof. 

The first thing that Quant does is sleep for 180 seconds (og 100% fud reboot antivirus runtime bypass). 
![quant_sleep]({{ site.baseurl }}/images/quant_sleep.png)

It then proceeds to decrypt all the strings at once to ensure that reversing it is very easy. **URLDownloadToFileA**? Why is this "professional dll loader/dropper" using win32api functions to preform it's core task? Other interesting strings include the **":Zone.Identifier"**, presumably to strip the identifier flag when the file is downloaded off the internet. To determine whether the system is 32 bit or 64 bit, it reads the "ProgramFiles Dir (x86)". If there is an "x86" in the program files directory, it is a 64 bit system. 

The malware then generates it's unique ID by reading the MachineGuid key at *"SOFTWARE\Microsoft\Cryptography"*, reading only the numbers, then reading 8 numbers starting from the 5th. It will use this GUID to create a new folder at the **Appdata\Roaming\<Guid>\svchost.exe** path, and copying an instance of itself to the path.
![quant_guid]({{ site.baseurl }}/images/quant_guid.png)

Quant checks for a number of antiviruses by comparing registry keys, exiting if any of them are found.

* Kaspersky
  * "kis" "SOFTWARE\KasperskyLab\LicStrg"
* Panda
  * "FirewallName" "SOFTWARE\Panda Software\Setup" 
* Norton Security
  * "TaskbarGroupIcon" "SOFTWARE\CLasses\Applications\NS.exe" 
* Dr Web
  * "DisplayName" "SYSTEM\ControlSet001\services\DrWebLwf"
* Bitdefender
  * "InstallPath" "SOFTWARE\Bitdefender Agent\Install"
* Bullguard
  * "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\bullguard.exe"

It then edits the firewall to allow outbound traffic using the following command

`
netsh.exe advfirewall firewall add rule "name=Quant" "program=c:\users\appdata\<uid>\svchost.exe" dir=Out action=allow'
`

And also changes the permission of the folder and executable using a very undetected and elegant method, launching an instance of cmd.exe

`cmd.exe /c echo Y|CACLS "c:\users\<user>\appdata\roaming\<uid>\svchost.exe" /P "user:R"
cmd.exe /c echo Y|CACLS "c:\users\<user>\appdata\roaming\<uid>" /P "user:R"`


It also launches the new dropped executable using a non-resolved ShellExecuteA, before sleeping for a number of minutes. Very nice.

Then, it uses a very stealthy and undetected startup method, the runkey

`
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
`
{'fraction_non_alphanumeric': 0.08647489726639271, 'fraction_numerical': 0.01214936573164195, 'mean_word_length': 4.76519052523172, 'pattern_counts': {'":': 2, '<': 15, '<?xml version=': 0, '>': 15, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4207060', 'n_tokens_mistral': 1761, 'n_tokens_neox': 1583, 'n_words': 694}