Loading malware…
QakBot, also widely known as QuakBot or Qbot, is a long-running modular Windows banking trojan that evolved into a broader post-compromise malware platform frequently associated with enterprise intrusions and ransomware operations. Active since at least 2007, it has historically targeted financial information but later became notable for credential theft, internal propagation support, reconnaissance, and delivery of follow-on tooling including Cobalt Strike and ransomware.
QakBot is commonly delivered through phishing and malspam campaigns, including emails carrying ZIP archives or weaponized Microsoft Office documents that rely on user interaction and malicious macros. In observed campaigns, Excel 4.0 macros and other document-based execution chains downloaded additional payloads and abused legitimate Windows utilities such as regsvr32 for proxy execution of malicious DLLs.
Once established, QakBot has demonstrated modular post-exploitation behavior. Reported capabilities include process injection into legitimate Windows processes, persistence via scheduled tasks and autorun mechanisms, theft of Outlook and related mail credentials, host and network discovery using native commands and directory-enumeration tools, and lateral movement through remote services and administrative shares. Operators have also used it to weaken defenses, including adding antivirus exclusions. In some intrusions, QakBot activity was followed by deployment of Cobalt Strike for broader discovery and movement, with objectives including data exfiltration and preparation for ransomware execution. QakBot has also been linked to exploitation of PrintNightmare for SYSTEM-level execution during later intrusion stages.
QakBot communications have been observed over TLS, including use of self-signed certificates, and it is among malware families whose certificate characteristics have been studied for network detection opportunities. The malware is strongly associated with Windows environments and has repeatedly appeared in financially motivated intrusion ecosystems alongside families such as Emotet, TrickBot, Dridex, and Gozi.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
We found that Quakbot threat actors exploited the PrintNightmare vulnerability (CVE-2021-34527 – “Windows Print Spooler Remote Code Execution”) in the later stages of the attack to perform privileged file operations and code execution via the Windows Print Spooler service. | Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
This led us to suspect that ProxyLogon and ProxyShell vulnerabilities are being exploited. These vulnerabilities allow Quakbot threat actors to bypass email security policies and propagate Quakbot infections. ProxyLogon – CVE-2021-26855, CVE-2021-27065 | Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
This led us to suspect that ProxyLogon and ProxyShell vulnerabilities are being exploited. These vulnerabilities allow Quakbot threat actors to bypass email security policies and propagate Quakbot infections. ProxyShell – CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 | Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
This led us to suspect that ProxyLogon and ProxyShell vulnerabilities are being exploited. These vulnerabilities allow Quakbot threat actors to bypass email security policies and propagate Quakbot infections. ProxyLogon – CVE-2021-26855, CVE-2021-27065 | Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
This led us to suspect that ProxyLogon and ProxyShell vulnerabilities are being exploited. These vulnerabilities allow Quakbot threat actors to bypass email security policies and propagate Quakbot infections. ProxyShell – CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 | Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
This led us to suspect that ProxyLogon and ProxyShell vulnerabilities are being exploited. These vulnerabilities allow Quakbot threat actors to bypass email security policies and propagate Quakbot infections. ProxyShell – CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 | Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
MalwareBazaar pivot analysis ties this sample to a broader campaign cluster exploiting CVE-2025-8088 (WinRAR)... Second, CVE-2025-8088 (a WinRAR vulnerability) appears in three related samples from March 3-10. The password-protected RAR in our sample may be designed to exploit this same vulnerability during extraction. Without the password, we cannot confirm this -- but the pattern is suggestive.
Miscreants have been seen exploiting the Follina flaw, tracked as CVE-2022-30190, in the Windows Support Diagnostic Tool to deliver Qbot... Follina is a remote code execution (RCE) vulnerability in the Microsoft Support Diagnostic Tool; this can be exploited by getting an application, such as Word, to call out to the tool from a specially crafted document when opened.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
The March 3 sample tagged UAC-0252 provides a tentative attribution anchor... 2026-03-03 27d7a398... ZIP UKR, Quakbot, RClone-Stealer-Mega Algeria-Ukraine cooperation
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Qakbot also creates a fake persistence which is scheduled tasks to deceive us.
these templates use Excel 4.0 macros ... automatically run macros when victim press “ Enable Content ” button.
Qakbot also creates a fake persistence which is scheduled tasks to deceive us.
Qakbot also applied encryption techniques to conceal information, as well as encrypt the payload on memory.
In malware, we often see threat actors that tend to obfuscate or encrypt their code in order to slow down the analysis of security researchers... many authors tend to use open-source packers but also craft their own custom packers.
This technique is called Stack-Strings and will appear several times during the Qbot unpacking process.
Payload will find the address of the API functions through lookup a pre-computed hash based on the API function name.
In both cases, the Quakbot execution flow executes the regsvr32 process three times in order to load masqueraded DLL payloads (test, good, random).
Qakbot select which process to inject its unpacked code ... Copy the entire Qakbot payload to the memory created above ... overwrite the explorer.exe’s entry point
Qakbot does overwrite null bytes on the payload itself on disk ... Delete payload on disk.
all strings are encrypted and decrypted at runtime into memory only and destroyed right afterwards.
If successfully download one of the above payloads, it will use rundll32.exe to execute
Payload checks whether its name is in the blacklist ... checks whether the running processes are in the blacklist ... check with the blacklist included: A3E64E55_pr;VboxVideo;Red Hat VirtIO;QEMU.
Use API functions of kernel32 are FindResourceA; SizeofResource; LoadResource to load the data stored in this resource ...
payload uses the functions CreateToolhelp32Snapshot; Process32First; Process32Next to enumerate all the processes running on the victim machine
Payload uses API functions SetupDiGetClassDevsA, SetupDiEnumDeviceInfo, SetupDiGetDeviceRegistryPropertyA ... get information about the device on the system
Over the last six years there has been an increased shift by malware authors to secure their C&C communications using the SSL/TLS protocol to stymie detection and blend in with normal traffic.
113 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Appears only in navigation/related content, not part of the main reference.
A modular banking trojan that steals credentials, financial information, browser data, and Outlook passwords; it spreads via phishing emails and weaponized Excel documents, uses regsvr32 and process injection for execution and persistence, performs discovery and lateral movement, deploys Cobalt Strike, and has been observed preceding ransomware deployment.
Referenced as a malware family found in a related campaign sample within the broader Ukraine-targeting cluster; the analyzed BES PDF lure itself did not reveal its final payload.
A tertiary malware tool observed as a single LNK sample associated with the same infrastructure as the main operation.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.