{
  "family": "qadars",
  "sample_count": 5,
  "category": "trojan",
  "description": "Trojan:Win32/Qadars is a highly sophisticated, commercially sold banking trojan and botnet framework. Its primary objective is to facilitate severe financial fraud by stealing banking credentials, bypassing Multi-Factor Authentication (MFA), and allowing attackers to initiate unauthorized wire transfers directly from the victim's compromised machine. It is known for its advanced 'web inject' capabilities and its ability to bypass two-factor authentication by occasionally deploying companion mobile malware to the victim's smartphone.<br><br><b>Understanding Qadars (Banking Trojans)</b><br>To a victim, a Qadars infection is invisible until money is missing from their accounts. For a financial institution, it represents a critical threat capable of defeating standard anti-fraud measures. Qadars specializes in Man-in-the-Browser (MitB) attacks, allowing the attacker to interact with the victim's bank session while the victim is actively logged in, bypassing IP and device fingerprinting checks.<br><br><b>Execution and Web Injection Mechanics</b><br>Qadars is typically distributed via targeted malspam (`T1566.001`), exploit kits (like Angler or Rig), or dropped by other loaders. Upon execution, it achieves persistence (`T1547.001`) and heavily utilizes API hooking and process injection (`T1055`) to embed itself into web browsers (Chrome, Firefox, IE). When the victim navigates to a targeted banking URL, Qadars uses 'Web Injects' (`T1185`) to dynamically alter the HTML/JavaScript of the bank's page before it renders on the screen. It can present fake login fields asking for Social Security numbers, ATM PINs, or prompt the user to download a 'security app' to their phone (which is actually a malicious SMS interceptor). Furthermore, it captures the data and sends it to the C2 server, allowing attackers to seamlessly bypass MFA.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is direct, massive financial theft. Host-based IoCs include EDR alerts for known banking trojan signatures, suspicious DLLs injected into browser processes (`chrome.exe`, `firefox.exe`), and unexpected outbound network connections from those browsers to known malicious C2 panels (often utilizing DGAs). Network IoCs include the downloading of 'web inject' configuration files from the C2 infrastructure.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1555.003",
    "T1055",
    "T1071.001",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Man-in-the-Browser / Web Injects)",
      "tactic": "Collection"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Hooking browser APIs)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1555.003",
      "name": "Credentials from Password Stores: Credentials from Web Browsers",
      "tactic": "Credential Access"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols (C2 communication)",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to sever the C2 connection and prevent the attacker from initiating fraudulent transactions.",
    "Contact the victim's financial institutions immediately to freeze accounts and alert them to the high probability of a Man-in-the-Browser compromise.",
    "Assume all web credentials stored on or entered into the machine have been stolen, and mandate enterprise-wide password resets.",
    "If the user was prompted to install a mobile app, their smartphone must also be isolated and forensically analyzed for SMS interceptor malware."
  ],
  "what_to_avoid": [
    "Do not rely on standard MFA (like SMS codes) to protect accounts if Qadars is suspected, as the attacker is operating *from* the authenticated session or intercepting the SMS.",
    "Avoid simply running an AV scan and leaving the machine online; banking trojans require a complete wipe and reimage to ensure the deep API hooks are removed."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}