Loading malware…
QakBot, also known as QBot, QuackBot, and Pinkslipbot, is a long-running Windows malware family first observed in 2007. It began as a banking trojan focused on credential theft, keystroke capture, and financial fraud, and later evolved into a modular loader and intrusion-enablement platform used to deliver additional payloads, including ransomware. It has been associated with large-scale criminal operations and has been used by multiple threat actors and affiliate ecosystems as an initial access and post-compromise malware component.
QakBot is typically distributed through phishing-driven campaigns, including malicious attachments, hijacked email threads, fake or compromised websites, and HTML smuggling chains. Observed delivery patterns have included password-protected archives, disk-image containers, shortcut-based execution chains, and other user-assisted infection flows designed to evade perimeter inspection and Mark-of-the-Web protections.
On infected systems, QakBot employs extensive anti-analysis and defense-evasion measures. Reported behaviors include encrypted strings and configuration data, dynamic API resolution through hashing, sandbox and emulator checks, virtualization detection, process and module inspection for analyst tools, and security-product discovery. It can identify installed antivirus products and peripheral devices, gather detailed host profiling data, and use built-in Windows utilities and WMI for reconnaissance across the local system and domain environment.
QakBot supports persistence through mechanisms including registry-based autoruns and scheduled tasks, and it has stored configuration data in the Windows Registry. It is also capable of copying itself, relaunching in staged execution branches, and maintaining long-term access on compromised hosts. For execution and stealth, QakBot has used process injection and process hollowing into legitimate Windows binaries.
Operationally, QakBot functions as both an information stealer and a loader. It has been documented stealing sensitive data and credentials, capturing keystrokes, propagating within networks, and enabling remote code execution or operator-directed follow-on activity. Its command-and-control communications have used encrypted configurations and encrypted HTTP-based traffic. In later-stage intrusions, QakBot has been used to support broader criminal objectives such as lateral movement, network scanning, payload delivery, and ransomware deployment.
QakBot has been notably linked to cybercrime delivery ecosystems and has been delivered by or alongside other malware families and access operations. It has also been referenced in operations involving groups such as TA577 and in intrusion chains later associated with ransomware actors including Black Basta. Law-enforcement disruption in 2023 significantly impacted its operations, but QakBot remains one of the most widely recognized malware families in the banking-trojan-to-loader lineage.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
6 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Black Basta infections began with Qakbot delivered by email and macro-based MS Office documents, ISO+LNK droppers and .docx documents exploiting the MSDTC remote code execution vulnerability, CVE-2022-30190.
These vulnerabilities are designated as CVE-2020-1472 (Zerologon) ... In the Qbot and Zerologon Lead To Full Domain Compromise report we saw ZeroLogon. | IcedID, Qbot, and Gootloader have all been observed making use of Scheduled Tasks ... Process injection was used both by initial access malware like Qbot ... In one of the earliest reports from the year, we observed Qbot continue to steal email inboxes from infected systems for use in later campaigns.
"The threat actor gained initial access to the organization via Qakbot infection..." | The threat actor gained initial access to the organization via Qakbot infection, followed by the exploitation of a Windows CLFS vulnerability (CVE-2023-28252) to elevate their privileges on affected devices.
Microsoft previously addressed an actively exploited zero-day flaw in DWM in May 2024 (CVE-2024-30051), which was described as a privilege escalation flaw that was abused by multiple threat actors, in connection with the distribution of QakBot and other malware families.
Windows Office Product Spawned Uncommon Process ... CVE-2023-21716 Word RTF Heap Corruption, CVE-2023-36884 Office and Windows HTML RCE Vulnerability ...
Threat Details and IOCs Malware: ... Qbot ...
20 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TA577, are a Russia-based threat group that have been reported to deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike in ongoing phishing campaigns since 2020.
Since the Emotet takedown, Proofpoint observed consistent, ongoing activity from The Trick, Dridex, Qbot, IcedID, ZLoader, Ursnif, and many others in our data serving as first-stage malware payloads in attempts to enable further infections, including ransomware attacks.
The group has overwhelmingly leveraged initial access gained via UNC2633 and UNC2500 QAKBOT botnet infections to deploy BASTA ransomware. QAKBOT is typically distributed via phishing emails containing malicious links or attachments.
Since the Emotet takedown, Proofpoint observed consistent, ongoing activity from The Trick, Dridex, Qbot, IcedID, ZLoader, Ursnif, and many others in our data serving as first-stage malware payloads in attempts to enable further infections, including ransomware attacks.
The group has overwhelmingly leveraged initial access gained via UNC2633 and UNC2500 QAKBOT botnet infections to deploy BASTA ransomware. QAKBOT is typically distributed via phishing emails containing malicious links or attachments.
The group has overwhelmingly leveraged initial access gained via UNC2633 and UNC2500 QAKBOT botnet infections to deploy BASTA ransomware. QAKBOT is typically distributed via phishing emails containing malicious links or attachments.
38 distinct techniques documented for this family, organized by ATT&CK tactic.
to lure victims onto fake websites that use exploits to execute Qbot onto a victim’s machine
Qbot uses CScript.exe to run the code ... uses the Windows Management Instrumentation (WMI) service to copy a file ... using a WMI object to run QBot is a better way than directly calling CreateProcess
Persistence QakBot sets itself to run on system reboot through a registry entry or Scheduled Task.
Qbot has the ability to run PowerShell code ... C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -Command
Persistence QakBot sets itself to run on system reboot through a registry entry or Scheduled Task.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
Persistence QakBot sets itself to run on system reboot through a registry entry or Scheduled Task.
one of the most important methods done by this WMI process is Process injection ... Write payload into Remote Process and Set Entry Point
Process Hollowing QakBot selects a system process for process hollowing based on the machine’s architecture (32-bit or 64-bit) and the installed antivirus software.
Qakbot comes with encrypted strings inside the .data section, These strings are encrypted using a XOR key and that key is encrypted using AES algorithm.
QakBot uses Windows API Hashing (Dynamic API Resolution) to evade signature-based anti-malware scanners and make static analysis harder.
the sample tries to connect to this legal website and download this image which is PE file
one of the most important methods done by this WMI process is Process injection ... Write payload into Remote Process and Set Entry Point
Process Hollowing QakBot selects a system process for process hollowing based on the machine’s architecture (32-bit or 64-bit) and the installed antivirus software.
Qbot Encrypts all of its strings and C2 Server to avoid static detection ... then it goes further to decrypt this resource using RC4
Environment Detection : Qakbot includes checks to detect if it is running in a virtual machine or sandbox environment, commonly used tools for malware analysis. If such conditions are detected, Qakbot may change its behavior or terminate itself to avoid detection.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
the first action done inside sub_408922 is querying a value from the registry related to User’s profile paths
Here is the list of commands that can be used to gather information about the system: ipconfig /all Displays detailed configuration information about all network interfaces.
net view Lists information about shared resources on remote systems.
whoami /all Displays user, group, and privileges information for the current user.
netstat -nao Lists active network connections and associated processes.
A competitor killer feature Scans of /proc for memory signatures of Mirai, QBOT, Vamp, Anime and dvrHelper
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
the sample next will parse the command line and try to check if the file “ C :_INTERNAL__ _empty ” exists
ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.
net share Lists information about shared resources on the local system. net view Lists information about shared resources on remote systems.
nltest /domain_trusts /all_trusts Lists all domain trusts established with the current domain.
Environment Detection : Qakbot includes checks to detect if it is running in a virtual machine or sandbox environment, commonly used tools for malware analysis. If such conditions are detected, Qakbot may change its behavior or terminate itself to avoid detection.
Qakbot uses the GetFileAttributesW function to check for a folder "C:\INTERNAL__empty." If this directory exists, it suggests that the environment might be used for analysis, such as Microsoft Defender emulation or sandbox, and then the process will be terminated.
491 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as one of several malware signatures TuxBot attempts to kill on infected devices.
QakBot1
Mentioned as an example of a malware family that commonly uses password-protected ZIP archives containing malicious documents for delivery.
Loader used to gain initial access before SystemBC deployment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.