Loading malware…
QakBot, also known as QBot, QuackBot, and Pinkslipbot, is a long-running modular banking trojan first observed in 2007 that evolved into a general-purpose malware delivery platform used by financially motivated actors. It originally targeted governments and businesses for financial fraud by stealing credentials, keystrokes, and other sensitive data, and later expanded into a loader/dropper role that supports remote code execution, network reconnaissance, self-propagation, and follow-on payload delivery including ransomware.
The malware is commonly delivered through phishing campaigns, including malicious attachments, fake websites, hijacked email threads, password-protected ZIP archives containing Office documents, and HTML smuggling chains. Reported QakBot delivery sequences include HTML files that download password-protected ZIP archives containing IMG/ISO disk images and malicious LNK files. QakBot operators used HTML smuggling extensively in 2022 and 2023, and the malware has also been associated with phishing activity by TA577. Black Basta was reported to use QakBot loader access in November 2022, and leaked Black Basta chats indicated the August 2023 law-enforcement takedown of QakBot disrupted their operations.
QakBot performs extensive host discovery and anti-analysis. Reported behaviors include identifying installed antivirus products, identifying peripheral devices, enumerating running processes, checking for virtualization and sandbox artifacts, and detecting analysis tools. It can gather system and user profiling data such as OS version, domain trusts, computer name, username, uptime, screen resolution, installed programs, BIOS, disk, memory, processor, hardware ID, installed languages, and antivirus information. It also executes built-in Windows commands including ipconfig /all, whoami /all, nltest /domain_trusts /all_trusts, qwinsta, nslookup for LDAP records, net share, net localgroup, netstat -nao, net view, route print, and arp -a.
QakBot uses encrypted strings and encrypted configuration data, dynamic API resolution, and embedded resources. Analyses in the content describe RC4-decrypted resources in older samples and AES-encrypted configuration and strings in QakBot version 5.0, along with CRC32-based API hashing with an XOR layer. It mainly uses HTTP for command-and-control, with AES-encrypted and Base64-encoded payloads, and reported samples contained large C2 IP lists and malicious download URLs.
Persistence and execution mechanisms described in the content include storing configuration information in a randomly named subkey under HKCU\Software\Microsoft, writing encrypted configuration data to .dat files under user profile or AppData paths, creating Run registry entries, Startup folder LNK files, PowerShell-based persistence, and scheduled tasks. QakBot can copy itself via WMI and VBScript, use COM and WMI interfaces such as IWbemLocator::ConnectServer, and perform process injection or process hollowing by creating suspended processes, mapping or writing payloads into them, modifying thread context, and resuming execution. Legitimate binaries cited as hollowing targets include AtBroker.exe, xwizard.exe, explorer.exe, wermgr.exe, OneDriveSetup.exe, msra.exe, and mobsync.exe.
Known indicators directly mentioned in the content include sample SHA-256 hashes F5FF6DBF5206CC2DB098B41F5AF14303F6DC43E36C5EC02604A50D5CFECF4790 and af6a9b7e7aefeb903c76417ed2b8399b73657440ad5f8b48a25cfe5e97ff868f, resource hash 118FC3D93D6E34B8F1A817313E218A3A4F5BAF996E03CD2BE34E237B197FA0F3, botnet ID spx143, and download URLs such as st29[.]ru/tbzirttmcnmb/88888888.png, restaurantbrighton[.]ru/uyqcb/88888888.png, royalapartments[.]pl/vtjwwoqxaix/88888888.png, alergeny.dietapacjenta[.]pl/pgaakzs/88888888.png, and egyorg[.]com/vxvipjfembb/88888888.png.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Black Basta infections began with Qakbot delivered by email and macro-based MS Office documents, ISO+LNK droppers and .docx documents exploiting the MSDTC remote code execution vulnerability, CVE-2022-30190.
These vulnerabilities are designated as CVE-2020-1472 (Zerologon) ... In the Qbot and Zerologon Lead To Full Domain Compromise report we saw ZeroLogon. | IcedID, Qbot, and Gootloader have all been observed making use of Scheduled Tasks ... Process injection was used both by initial access malware like Qbot ... In one of the earliest reports from the year, we observed Qbot continue to steal email inboxes from infected systems for use in later campaigns.
"The threat actor gained initial access to the organization via Qakbot infection..." | The threat actor gained initial access to the organization via Qakbot infection, followed by the exploitation of a Windows CLFS vulnerability (CVE-2023-28252) to elevate their privileges on affected devices.
Microsoft previously addressed an actively exploited zero-day flaw in DWM in May 2024 (CVE-2024-30051), which was described as a privilege escalation flaw that was abused by multiple threat actors, in connection with the distribution of QakBot and other malware families.
Windows Office Product Spawned Uncommon Process ... CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability ...
Threat Details and IOCs Malware: ... Qbot ...
20 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TA577, are a Russia-based threat group that have been reported to deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike in ongoing phishing campaigns since 2020.
Since the Emotet takedown, Proofpoint observed consistent, ongoing activity from The Trick, Dridex, Qbot, IcedID, ZLoader, Ursnif, and many others in our data serving as first-stage malware payloads in attempts to enable further infections, including ransomware attacks.
The group has overwhelmingly leveraged initial access gained via UNC2633 and UNC2500 QAKBOT botnet infections to deploy BASTA ransomware. QAKBOT is typically distributed via phishing emails containing malicious links or attachments.
Since the Emotet takedown, Proofpoint observed consistent, ongoing activity from The Trick, Dridex, Qbot, IcedID, ZLoader, Ursnif, and many others in our data serving as first-stage malware payloads in attempts to enable further infections, including ransomware attacks.
The group has overwhelmingly leveraged initial access gained via UNC2633 and UNC2500 QAKBOT botnet infections to deploy BASTA ransomware. QAKBOT is typically distributed via phishing emails containing malicious links or attachments.
The group has overwhelmingly leveraged initial access gained via UNC2633 and UNC2500 QAKBOT botnet infections to deploy BASTA ransomware. QAKBOT is typically distributed via phishing emails containing malicious links or attachments.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
to lure victims onto fake websites that use exploits to execute Qbot onto a victim’s machine
Qbot uses CScript.exe to run the code ... uses the Windows Management Instrumentation (WMI) service to copy a file ... using a WMI object to run QBot is a better way than directly calling CreateProcess
Persistence QakBot sets itself to run on system reboot through a registry entry or Scheduled Task.
Qbot has the ability to run PowerShell code ... C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command
Persistence QakBot sets itself to run on system reboot through a registry entry or Scheduled Task.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
Persistence QakBot sets itself to run on system reboot through a registry entry or Scheduled Task.
one of the most important methods done by this WMI process is Process injection ... Write payload into Remote Process and Set Entry Point
Process Hollowing QakBot selects a system process for process hollowing based on the machine’s architecture (32-bit or 64-bit) and the installed antivirus software.
Qakbot comes with encrypted strings inside the .data section, These strings are encrypted using a XOR key and that key is encrypted using AES algorithm.
QakBot uses Windows API Hashing (Dynamic API Resolution) to evade signature-based anti-malware scanners and make static analysis harder.
the sample tries to connect to this legal website and download this image which is PE file
one of the most important methods done by this WMI process is Process injection ... Write payload into Remote Process and Set Entry Point
Process Hollowing QakBot selects a system process for process hollowing based on the machine’s architecture (32-bit or 64-bit) and the installed antivirus software.
Qbot Encrypts all of its strings and C2 Server to avoid static detection ... then it goes further to decrypt this resource using RC4
Environment Detection : Qakbot includes checks to detect if it is running in a virtual machine or sandbox environment, commonly used tools for malware analysis. If such conditions are detected, Qakbot may change its behavior or terminate itself to avoid detection.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
the first action done inside sub_408922 is querying a value from the registry related to User’s profile paths
Here is the list of commands that can be used to gather information about the system: ipconfig /all Displays detailed configuration information about all network interfaces.
net view Lists information about shared resources on remote systems.
whoami /all Displays user, group, and privileges information for the current user.
netstat -nao Lists active network connections and associated processes.
Qakbot loops through running processes on the system and compares their executable names against well-known static and dynamic malware analysis tools.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
the sample next will parse the command line and try to check if the file “ C :_INTERNAL__ _empty ” exists
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
net share Lists information about shared resources on the local system. net view Lists information about shared resources on remote systems.
nltest /domain_trusts /all_trusts Lists all domain trusts established with the current domain.
Environment Detection : Qakbot includes checks to detect if it is running in a virtual machine or sandbox environment, commonly used tools for malware analysis. If such conditions are detected, Qakbot may change its behavior or terminate itself to avoid detection.
Qakbot uses the GetFileAttributesW function to check for a folder "C:\INTERNAL__empty." If this directory exists, it suggests that the environment might be used for analysis, such as Microsoft Defender emulation or sandbox, and then the process will be terminated.
491 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
QakBot1
Mentioned as an example of a malware family that commonly uses password-protected ZIP archives containing malicious documents for delivery.
Loader used to gain initial access before SystemBC deployment.
Referenced as malware whose operators used HTML smuggling to deliver initial access payloads.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.