{"id":9823,"date":"2021-07-13T14:02:45","date_gmt":"2021-07-13T11:02:45","guid":{"rendered":"https:\/\/www.kaspersky.com.tr\/blog\/?p=9823"},"modified":"2021-07-13T14:17:01","modified_gmt":"2021-07-13T11:17:01","slug":"icedid-qbot-banking-trojans-in-spam","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.tr\/blog\/icedid-qbot-banking-trojans-in-spam\/9823\/","title":{"rendered":"\u0130\u015fle ilgili gibi g\u00f6r\u00fcnen bankac\u0131l\u0131k Truva atlar\u0131"},"content":{"rendered":"<p>G\u00fcn i\u00e7inde y\u00fczlerce e-posta al\u0131p g\u00f6nderiyorsan\u0131z, e-posta eklerinin otomatik olarak h\u0131zl\u0131ca okunmas\u0131 ve indirilmesi olduk\u00e7a \u00e7ekici gelebilir. Elbette siber su\u00e7lular da bunu avantaja \u00e7eviriyor ve i\u00e7lerinde <a href=\"https:\/\/www.kaspersky.com.tr\/blog\/office-365-phishing-via-gdocs\/9614\/\" target=\"_blank\" rel=\"noopener\">kimlik av\u0131 ba\u011flant\u0131lar\u0131ndan<\/a> k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlara kadar hemen hemen her \u015feyin olabilece\u011fi \u00f6nemli gibi g\u00f6r\u00fcnen belgeler g\u00f6nderiyorlar. Uzmanlar\u0131m\u0131z k\u0131sa s\u00fcre \u00f6nce IcedID ve Qbot <a href=\"https:\/\/encyclopedia.kaspersky.com\/glossary\/banker-trojan-banker\/\" target=\"_blank\" rel=\"noopener\">bankac\u0131l\u0131k Truva Atlar\u0131n\u0131<\/a> da\u011f\u0131tan \u00e7ok benzer iki spam kampanyas\u0131 <a href=\"https:\/\/securelist.com\/malicious-spam-campaigns-delivering-banking-trojans\/102917\/\" target=\"_blank\" rel=\"noopener\">ke\u015ffettiler<\/a>.<\/p>\n<h2>K\u00f6t\u00fc ama\u00e7l\u0131 belgeler i\u00e7eren spam mesajlar<\/h2>\n<p>Her iki e-posta da bir i\u015f yaz\u0131\u015fmas\u0131 gibi g\u00f6r\u00fcn\u00fcyordu. \u0130lk kampanyada sald\u0131rganlar, sahte bir nedenden \u00f6t\u00fcr\u00fc tazminat talebinde bulunuyor veya bir i\u015flemin iptaline ili\u015fkin bir \u015feyler yaz\u0131yorlard\u0131. E-postan\u0131n ekinde, dosya isminde CompensationClaim ve devam\u0131nda birka\u00e7 say\u0131n\u0131n yer ald\u0131\u011f\u0131, s\u0131k\u0131\u015ft\u0131r\u0131lm\u0131\u015f bir Excel dosyas\u0131 bulunuyordu. \u0130kinci kampanyada ise konu \u00f6demeler ve s\u00f6zle\u015fmelerle ilgiliydi ve belgeyi i\u00e7eren ar\u015fiv dosyas\u0131n\u0131n tutuldu\u011fu hacklenmi\u015f internet sitesine bir ba\u011flant\u0131 yer al\u0131yordu.<\/p>\n<p>Her iki durumda da sald\u0131rganlar\u0131n amac\u0131, al\u0131c\u0131y\u0131 k\u00f6t\u00fc ama\u00e7l\u0131 Excel dosyas\u0131n\u0131 a\u00e7maya ve i\u00e7indeki makroyu \u00e7al\u0131\u015ft\u0131rmaya ikna etmek, b\u00f6ylece kurban\u0131n kulland\u0131\u011f\u0131 cihaza IcedID veya (daha az yayg\u0131n olan) Qbot\u2019u indirmekti.<\/p>\n<p><strong><input type=\"hidden\" class=\"category_for_banner\" value=\"banking\"><\/strong><\/p>\n<h2>IcedID ve Qbot<\/h2>\n<p>IcedID\u2019in <a href=\"https:\/\/threatpost.com\/new-icedid-trojan-targets-us-banks\/128851\/\" target=\"_blank\" rel=\"noopener nofollow\">ara\u015ft\u0131rmac\u0131lar\u0131n dikkatini ilk kez \u00e7ekti\u011fi<\/a> 2017\u2019den, Qbot\u2019un ise <a href=\"https:\/\/threatpost.com\/qbot-trojan-us-banking-customers\/156624\/\" target=\"_blank\" rel=\"noopener nofollow\">2008\u2019den beri<\/a> kullan\u0131l\u0131yor olmas\u0131 nedeniyle her iki bankac\u0131l\u0131k truva at\u0131 da uzun y\u0131llard\u0131r bilinen bir durum. Uzun y\u0131llard\u0131r kullan\u0131lmas\u0131n\u0131n yan\u0131nda, sald\u0131rganlar da bu s\u00fcre boyunca s\u00fcrekli olarak tekniklerini geli\u015ftirmeye devam ettiler. \u00d6rne\u011fin bir seferinde, tespit edilmesi olduk\u00e7a zor olan <a href=\"https:\/\/www.kaspersky.com.tr\/blog\/digital-steganography\/6206\/\" target=\"_blank\" rel=\"noopener\">steganografi<\/a> ad\u0131ndaki bir y\u00f6ntem kullanarak IcedID\u2019nin ana bile\u015fenini bir PNG g\u00f6r\u00fcnt\u00fcs\u00fcne gizlemeyi ba\u015fard\u0131lar.<\/p>\n<p>Bug\u00fcn her iki k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131ma da g\u00f6lge pazardan (shadow market) ula\u015fmak m\u00fcmk\u00fcn; yaz\u0131l\u0131mlar\u0131n yarat\u0131c\u0131lar\u0131n\u0131n yan\u0131s\u0131ra, yaz\u0131l\u0131m\u0131 sat\u0131n alan \u00e7ok say\u0131da ki\u015fi de bu truva atlar\u0131n\u0131 da\u011f\u0131t\u0131yor. K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131m\u0131n ana g\u00f6revi, tercihen \u015firket hesaplar\u0131 (dolay\u0131s\u0131yla ticari e-postalar\u0131n kullan\u0131ld\u0131\u011f\u0131) olmak \u00fczere banka hesaplar\u0131na ait oturum a\u00e7ma kimlik bilgilerini ve banka kart\u0131 bilgilerini ve \u00e7almak. Truva atlar\u0131 ama\u00e7lar\u0131na ula\u015fmak i\u00e7in \u00e7ok \u00e7e\u015fitli y\u00f6ntemlerden yararlan\u0131yor. \u00d6rne\u011fin:<\/p>\n<ul>\n<li>Kullan\u0131c\u0131 taraf\u0131ndan girilen verileri ele ge\u00e7irmek i\u00e7in bir web sayfas\u0131na k\u00f6t\u00fc ama\u00e7l\u0131 bir komut dosyas\u0131 yerle\u015ftirebilirler,<\/li>\n<li>\u00c7evrimi\u00e7i bankac\u0131l\u0131k kullan\u0131c\u0131lar\u0131n\u0131 sahte bir giri\u015f sayfas\u0131na y\u00f6nlendirebilirler,<\/li>\n<li>Taray\u0131c\u0131da kay\u0131tl\u0131 verileri \u00e7alabilirler.<\/li>\n<\/ul>\n<p>Ayr\u0131ca Qbot, parolalar\u0131 ele ge\u00e7irmek i\u00e7in tu\u015f vuru\u015flar\u0131n\u0131 kaydedebilme \u00f6zelli\u011fine de sahip.<\/p>\n<p>Ne yaz\u0131k ki kurbanlar\u0131 bekleyen tek sorun bankac\u0131l\u0131k verilerinin \u00e7al\u0131nmas\u0131 da de\u011fil. \u00d6rne\u011fin IcedID, fidye yaz\u0131l\u0131m\u0131 dahil olmak \u00fczere di\u011fer k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131 da vir\u00fcsl\u00fc cihazlara indirebiliyor. Qbot\u2019un sahip oldu\u011fu di\u011fer \u00f6zellikler aras\u0131nda ise daha fazla spam kampanyas\u0131nda kullanmak amac\u0131yla <a href=\"https:\/\/research.checkpoint.com\/2020\/exploring-qbots-latest-attack-methods\/\" target=\"_blank\" rel=\"noopener nofollow\">e-posta dizilerini \u00e7almak<\/a> ve yaz\u0131l\u0131m\u0131 kullanan ki\u015filere kurbanlar\u0131n bilgisayarlar\u0131na uzaktan eri\u015febilmelerini sa\u011flamak yer al\u0131yor. \u00d6zellikle i\u015f cihazlar\u0131nda bu olduk\u00e7a ciddi sonu\u00e7lara yol a\u00e7abilir.<\/p>\n<h2>Bankac\u0131l\u0131k Truva Atlar\u0131ndan nas\u0131l korunursunuz<\/h2>\n<p>Siber su\u00e7lular ne kadar yetenekli olurlarsa olsun, g\u00fcvenli\u011finizi sa\u011flamak i\u00e7in Amerika\u2019y\u0131 yeniden ke\u015ffetmeye gerek yok. S\u00f6z konusu spam kampanyalar\u0131n\u0131n her ikisinin de ba\u015far\u0131s\u0131, e-postalar\u0131n g\u00f6nderildi\u011fi ki\u015filerin riskli eylemlerde bulunmas\u0131na ba\u011fl\u0131d\u0131r \u2014 k\u00f6t\u00fc ama\u00e7l\u0131 dosyay\u0131 a\u00e7maz ve makronun y\u00fcr\u00fct\u00fclmesine izin vermezlerse, bu y\u00f6ntemi kullanmak hi\u00e7bir i\u015fe yaramaz. B\u00f6yle bir olay\u0131n kurban\u0131 olma ihtimalinizi azaltmak i\u00e7in<\/p>\n<ul>\n<li>Gelen e-postadaki alan ad\u0131 da dahil olmak \u00fczere, g\u00f6nderenin kimli\u011fini kontrol edin. \u00d6rne\u011fin, bir y\u00fcklenici veya kurumsal m\u00fc\u015fteri oldu\u011funu iddia etmesine ra\u011fmen Gmail adresi kullanan biri \u015f\u00fcpheli olabilir. Ve e\u011fer g\u00f6nderenin kim oldu\u011fu konusunda bir fikriniz yoksa, bunu \u00f6\u011frenmek i\u00e7in i\u015f arkada\u015flar\u0131n\u0131zdan yard\u0131m al\u0131n.<\/li>\n<li>Varsay\u0131lan olarak makrolar\u0131n y\u00fcr\u00fct\u00fclmesini engelleyin ve makrolar\u0131 veya di\u011fer i\u00e7erikleri etkinle\u015ftirmenizi gerektiren belgelere \u015f\u00fcpheyle yakla\u015f\u0131n. Dosyada makrolar\u0131n \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131 gerekti\u011finden ve bunun g\u00fcvenli oldu\u011fundan kesin olarak emin olmad\u0131\u011f\u0131n\u0131z s\u00fcrece asla makrolar\u0131 \u00e7al\u0131\u015ft\u0131rmay\u0131n.<\/li>\n<li><a href=\"https:\/\/www.kaspersky.com.tr\/internet-security?icid=tr_kdailyplacehold_acq_ona_smm__onl_b2c_kasperskydaily_wpplaceholder____kismd___\" target=\"_blank\" rel=\"noopener\">G\u00fcvenilir bir g\u00fcvenlik \u00e7\u00f6z\u00fcm\u00fc<\/a>\u00a0Ki\u015fisel bir cihazda \u00e7al\u0131\u015f\u0131yorsan\u0131z veya i\u015f istasyonu korumas\u0131 konusuna i\u015fvereniniz gereken \u00f6nemi vermiyorsa, cihaz\u0131n\u0131z\u0131n korundu\u011fundan emin olun. \u00dcr\u00fcnlerimiz, hem IcedID hem de Qbot\u2019u tespit edebilmenizi sa\u011flar.<\/li>\n<\/ul>\n<p><strong><input type=\"hidden\" class=\"category_for_banner\" value=\"banking\"><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Spam g\u00f6nderenler, \u00f6nemli gibi g\u00f6r\u00fcnen belgelerde k\u00f6t\u00fc ama\u00e7l\u0131 makrolar\u0131 kullanarak IcedID ve Qbot ad\u0131ndaki bankac\u0131l\u0131k k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131n\u0131 da\u011f\u0131t\u0131yor.<\/p>\n","protected":false},"author":2477,"featured_media":9824,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1351],"tags":[2089,2445,2447,2448,2446,240],"class_list":{"0":"post-9823","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-bankacilik-truva-atlari","9":"tag-icedid","10":"tag-kotu-amacli-ekler","11":"tag-makrolar","12":"tag-qbot","13":"tag-spam"},"hreflang":[{"hreflang":"tr","url":"https:\/\/www.kaspersky.com.tr\/blog\/icedid-qbot-banking-trojans-in-spam\/9823\/"},{"hreflang":"en-in","url":"https:\/\/www.kaspersky.co.in\/blog\/icedid-qbot-banking-trojans-in-spam\/23048\/"},{"hreflang":"en-ae","url":"https:\/\/me-en.kaspersky.com\/blog\/icedid-qbot-banking-trojans-in-spam\/18530\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/icedid-qbot-banking-trojans-in-spam\/25003\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/icedid-qbot-banking-trojans-in-spam\/23011\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/icedid-qbot-banking-trojans-in-spam\/22303\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/icedid-qbot-banking-trojans-in-spam\/25622\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/icedid-qbot-banking-trojans-in-spam\/25092\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/icedid-qbot-banking-trojans-in-spam\/31030\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/icedid-qbot-banking-trojans-in-spam\/40552\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/icedid-qbot-banking-trojans-in-spam\/17313\/"},{"hreflang":"pl","url":"https:\/\/plblog.kaspersky.com\/icedid-qbot-banking-trojans-in-spam\/15035\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/icedid-qbot-banking-trojans-in-spam\/27052\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/icedid-qbot-banking-trojans-in-spam\/31215\/"},{"hreflang":"nl","url":"https:\/\/www.kaspersky.nl\/blog\/icedid-qbot-banking-trojans-in-spam\/27280\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/icedid-qbot-banking-trojans-in-spam\/24090\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/icedid-qbot-banking-trojans-in-spam\/29425\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/icedid-qbot-banking-trojans-in-spam\/29217\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.tr\/blog\/tag\/bankacilik-truva-atlari\/","name":"bankac\u0131l\u0131k Truva Atlar\u0131"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/9823","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/users\/2477"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=9823"}],"version-history":[{"count":2,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/9823\/revisions"}],"predecessor-version":[{"id":9827,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/posts\/9823\/revisions\/9827"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media\/9824"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=9823"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=9823"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=9823"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}