Link: Download
Quantum Builder is a tool sold on the dark web that allows hackers to create malicious Windows shortcut files and other payloads to deliver malware, such as the Agent Tesla remote access trojan (RAT). It enables cybercriminals to execute sophisticated attacks by using techniques like user account control bypass and in-memory PowerShell scripts to evade detection.
Malware Delivery Mechanism
- File Types: Generates .lnk, .hta, and ISO payloads.
- Infection Chain: Typically starts with a spear-phishing email containing a compressed file (like a GZIP or ZIP archive) that includes the malicious shortcut.
- Execution Process: When the shortcut is executed, it runs embedded PowerShell scripts that can download and execute the final payload from a remote server.
Evasion Techniques
- User Account Control (UAC) Bypass: Uses the Microsoft Connection Manager Profile Installer (CMSTP) to execute malware with administrative privileges.
- Living Off the Land Binaries (LOLBins): Utilizes legitimate Windows tools to evade detection.
- Regular Updates: The developers frequently update the tool to enhance its evasion techniques and capabilities.
