Loading malware…
QakBot, also known as QBot, QuackBot, and Pinkslipbot, is a long-running Windows malware family first observed in 2007. It began as a banking trojan focused on credential theft, keystroke capture, and financial fraud, and later evolved into a modular loader and backdoor used to establish initial access, profile victims, spread within networks, and deliver follow-on payloads including Cobalt Strike and ransomware.
QakBot is commonly distributed through phishing-driven infection chains, including malicious attachments, hijacked email threads, password-protected archives, disk-image containers, and HTML smuggling. It has also been associated with campaigns exploiting Microsoft vulnerabilities to deliver the malware. Once executed, it performs extensive anti-analysis and anti-virtualization checks, dynamically resolves APIs, decrypts embedded strings and configuration data, and communicates with command-and-control infrastructure over encrypted HTTP-based channels.
On compromised systems, QakBot conducts broad host reconnaissance. Reported behaviors include identifying installed antivirus products, enumerating processes and analysis tools, collecting operating system and hardware details, querying WMI for system and security information, discovering domain relationships and network shares, and identifying peripheral devices. It can store configuration data in the Windows Registry, create persistence through Run entries and scheduled tasks, and use process injection or process hollowing to execute within legitimate Windows processes.
QakBot supports credential theft and keylogging, and it has been used to enable remote code execution and hands-on-keyboard post-compromise activity. It has also been observed attempting self-propagation and facilitating lateral movement through compromised environments. In enterprise intrusions, operators have used QakBot as an initial foothold before deploying additional tooling and ransomware, including in campaigns linked to groups such as Black Basta and Royal. Its role as an access broker and payload delivery platform made it one of the most significant cybercrime malware families prior to major law-enforcement disruption in 2023.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2024-30051 (CVSS skóre 7,8) Zero-day zraniteľnosť v knižnici Windows DWM Core Library by lokálny autentifikovaný útočník s oprávneniami štandardného používateľa mohol prostredníctvom zaslania špeciálne vytvorenej požiadavky zneužiť na eskaláciu privilégií (úroveň SYSTEM) a získať úplnú kontrolu nad systémom. Spoločnosť KASPERSKY informovala o phishingových kampaniach, ktoré túto zraniteľnosť aktívne zneužívajú na šírenie malvéru QAKBOT. | Spoločnosť KASPERSKY informovala o phishingových kampaniach, ktoré túto zraniteľnosť aktívne zneužívajú na šírenie malvéru QAKBOT.
Black Basta infections began with Qakbot delivered by email and macro-based MS Office documents, ISO+LNK droppers and .docx documents exploiting the MSDTC remote code execution vulnerability, CVE-2022-30190.
These vulnerabilities are designated as CVE-2020-1472 (Zerologon) ... In the Qbot and Zerologon Lead To Full Domain Compromise report we saw ZeroLogon. | IcedID, Qbot, and Gootloader have all been observed making use of Scheduled Tasks ... Process injection was used both by initial access malware like Qbot ... In one of the earliest reports from the year, we observed Qbot continue to steal email inboxes from infected systems for use in later campaigns.
"The threat actor gained initial access to the organization via Qakbot infection..." | The threat actor gained initial access to the organization via Qakbot infection, followed by the exploitation of a Windows CLFS vulnerability (CVE-2023-28252) to elevate their privileges on affected devices.
Windows Office Product Spawned Uncommon Process ... CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability ...
Threat Details and IOCs Malware: ... Qbot ...
21 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...Watermark Связанные группы и кампании 426352781 ShadowSyndicate, ботнет Qakbot...
TA577, are a Russia-based threat group that have been reported to deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike in ongoing phishing campaigns since 2020.
Since the Emotet takedown, Proofpoint observed consistent, ongoing activity from The Trick, Dridex, Qbot, IcedID, ZLoader, Ursnif, and many others in our data serving as first-stage malware payloads in attempts to enable further infections, including ransomware attacks.
The group has overwhelmingly leveraged initial access gained via UNC2633 and UNC2500 QAKBOT botnet infections to deploy BASTA ransomware. QAKBOT is typically distributed via phishing emails containing malicious links or attachments.
Since the Emotet takedown, Proofpoint observed consistent, ongoing activity from The Trick, Dridex, Qbot, IcedID, ZLoader, Ursnif, and many others in our data serving as first-stage malware payloads in attempts to enable further infections, including ransomware attacks.
The group has overwhelmingly leveraged initial access gained via UNC2633 and UNC2500 QAKBOT botnet infections to deploy BASTA ransomware. QAKBOT is typically distributed via phishing emails containing malicious links or attachments.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
After gaining privileged domain accounts, the group used them to move through the network.
to lure victims onto fake websites that use exploits to execute Qbot onto a victim’s machine
Qbot uses CScript.exe to run the code ... uses the Windows Management Instrumentation (WMI) service to copy a file ... using a WMI object to run QBot is a better way than directly calling CreateProcess
Persistence QakBot sets itself to run on system reboot through a registry entry or Scheduled Task.
Persistence QakBot sets itself to run on system reboot through a registry entry or Scheduled Task.
After gaining privileged domain accounts, the group used them to move through the network.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
Persistence QakBot sets itself to run on system reboot through a registry entry or Scheduled Task.
The two tools were also injected into legitimate Windows processes, making malicious activity harder to spot
Zero-day zraniteľnosti CVE-2024-30040 a CVE-2024-30051 sú aktívne zneužívané. | CVE-2024-30051 ... lokálny autentifikovaný útočník s oprávneniami štandardného používateľa mohol ... zneužiť na eskaláciu privilégií (úroveň SYSTEM) a získať úplnej kontroly nad systémom
Qakbot comes with encrypted strings inside the .data section, These strings are encrypted using a XOR key and that key is encrypted using AES algorithm.
QakBot uses Windows API Hashing (Dynamic API Resolution) to evade signature-based anti-malware scanners and make static analysis harder.
The two tools were also injected into legitimate Windows processes, making malicious activity harder to spot
After gaining privileged domain accounts, the group used them to move through the network.
Qbot Encrypts all of its strings and C2 Server to avoid static detection ... then it goes further to decrypt this resource using RC4
Environment Detection : Qakbot includes checks to detect if it is running in a virtual machine or sandbox environment, commonly used tools for malware analysis. If such conditions are detected, Qakbot may change its behavior or terminate itself to avoid detection.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
the first action done inside sub_408922 is querying a value from the registry related to User’s profile paths
Here is the list of commands that can be used to gather information about the system: ipconfig /all Displays detailed configuration information about all network interfaces.
net view Lists information about shared resources on remote systems.
The operators also used built-in Windows utilities to list users
A competitor killer feature Scans of /proc for memory signatures of Mirai, QBOT, Vamp, Anime and dvrHelper
used built-in Windows utilities to list users, groups, domain trusts, and available network shares.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
the sample next will parse the command line and try to check if the file “ C :_INTERNAL__ _empty ” exists
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
used built-in Windows utilities to list users, groups, domain trusts, and available network shares.
used built-in Windows utilities to list users, groups, domain trusts, and available network shares.
Environment Detection : Qakbot includes checks to detect if it is running in a virtual machine or sandbox environment, commonly used tools for malware analysis. If such conditions are detected, Qakbot may change its behavior or terminate itself to avoid detection.
491 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Initial access/backdoor malware used after spearphishing to establish control, persist via a Windows Registry Run key, and support lateral movement ahead of Royal ransomware deployment.
Botnet referenced in connection with Cobalt Strike watermark analysis on BitLaunch infrastructure.
Mentioned only as one of several malware signatures TuxBot attempts to kill on infected devices.
QakBot1
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.