Skip to main content

Qealler Information Stealer

Qealler is a Java-based information stealer that uses the ProGuard obfuscator to evade detection and deploys a Python-based tool to steal credentials.

Threat ID:
CC-2923
Category:
Trojan
Threat Severity:
Low
Threat Vector:
Email spam
Published:
7 February 2019 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Qealler is a Java-based information stealer that uses the ProGuard obfuscator to evade detection and deploys a Python-based tool to steal credentials.

Affected platforms

The following platforms are known to be affected:

Microsoft Windows

Microsoft Windows - All versions

Threat details

Qealler is delivered via spam email. It is distributed as a JAR file and disguised as an invoice related document.

Once installed, Qealler will locate and extract credentials and system information from web browsers, mail clients, databases and memory dumps using a module called QaZagne. It will then encrypt all stolen information, using an AES cipher, before sending to a command and control server.

Remediation steps

Type Step

To prevent and detect an infection, ensure that:

  • A robust program of education and awareness training is delivered to users to ensure they don’t open attachments or follow links within unsolicited emails.
  • All operating systems, anti-virus and other security products are kept up-to-date.
  • Regular anti-virus and security scans are performed on your organisation’s estate.
  • All day-to-day computer activities such as email and internet are performed using non-administrative accounts.
  • Strong password policies are in place.
  • Network, proxy and firewall logs should be monitored for suspicious activity.
  • User accounts accessed from affected devices should be reset on a clean computer.
  • Your organisation adopts a holistic all-round approach to Cyber Security as advocated by the 10 Steps to Cyber Security.

Last edited: 14 February 2020 2:53 pm