Loading story…
Researchers documented Qadars as a banking Trojan focused on web-injection fraud against financial institutions, with the heaviest activity observed in the Netherlands and additional targeting in France, Canada, India, Australia, and Italy. The malware hooked Firefox and Internet Explorer to perform man-in-the-browser attacks, delivered region-specific webinjects, stored downloaded configurations encrypted in the Windows registry, and later added FTP credential theft. Campaigns were linked to pay-per-install distribution and later to the Nuclear Exploit Kit, while some operations also used Android/Perkele malware to intercept SMS transaction codes and bypass two-factor authentication during fraudulent transfers.
Later reverse engineering tied a newer sample to a likely Qadars 3.0.0.0 variant that introduced a domain generation algorithm (DGA) for command-and-control discovery, a capability not highlighted in earlier reporting on version 2. The malware was found to generate up to 200 candidate domains per cycle, resolve them with gethostbyname, and retry after a 20-second sleep if none were reachable. The DGA was described as time-dependent and deterministic, seeded by the current week so domains rotated every seven days, producing 12-character second-level domains across .com, .org, and .net to make infrastructure tracking and takedown more difficult.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
On 2016-04-12, Johannes Bader analyzed a Qadars sample with version string 3.0.0.0 and concluded that version 3 likely introduced a domain generation algorithm for command-and-control discovery. The analysis noted earlier reporting on Qadars 2.0.0.0 had not mentioned a DGA.
On 2013-12-18, ESET published an analysis describing Qadars as a banking Trojan targeting users in six countries, especially the Netherlands, and documenting capabilities including webinjects, registry-stored encrypted configs, and later FTP credential theft.
Beginning in November 2013, ESET observed Win32/Qadars being distributed through the Nuclear Exploit Kit. Earlier infection vectors from May through October 2013 had remained unclear.
ESET reported that all observed Canadian detections of Win32/Qadars occurred in the last 15 days of October 2013. This identified a distinct country-specific targeting wave within the broader campaign.
ESET said the first major infection wave of Win32/Qadars occurred in late June 2013, with Italian users mainly targeted in that wave. Later campaigns shifted primarily toward Dutch users.
ESET reported that the first signs of the Win32/Qadars banking Trojan were observed in mid-May 2013. This marked the beginning of the activity window discussed in its analysis.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 21 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs documented **Qbot/QakBot** (also known as QBOT), a long-running modular Windows banking trojan used by multiple threat actors and ransomware affiliates. In the analyzed activity, the malware executed as a DLL through the legitimate Windows `regsvr32.exe` utility, used `cmd.exe` and `curl.exe`, injected into `explorer.exe`, copied itself into a randomly named directory beneath the user AppData path, and established persistence through Registry Run keys and scheduled tasks intended to run with **SYSTEM** privileges. Qbot used anti-analysis and defense-evasion checks to identify sandbox, monitoring, and security products, and could add its persistence location to Microsoft Defender exclusions when Defender was present. It avoided execution on systems configured for Russian and several Eastern European, Central Asian, and Caucasus-region languages. The malware communicated with a distributed C2 network over HTTP or TLS using encrypted, Base64-encoded JSON, enabling operators to deliver updates, execute shell or PowerShell commands, and inject or launch additional binaries; Elastic identified 138 associated IP addresses and linked the infrastructure to hundreds of malicious files.
Sep 9, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026
Researchers across multiple security firms documented how **QakBot** (also known as **Qbot**) has evolved from a banking trojan into a stealthier modular malware platform that steals credentials, injects into processes such as `explorer.exe`, and can act as a loader for follow-on ransomware. Reports describe delivery through phishing documents, exploit droppers, and open shares, with campaigns targeting financial institutions in the United States and additional banks in Canada and the Netherlands. Analysts also observed persistent development activity, frequent packing changes, browser-injection capabilities, FTP exfiltration, DGA-based command-and-control behavior, and increasingly organized build practices designed to frustrate signature-based detection. More recent samples show QakBot reducing on-disk artifacts by storing configuration in the Windows Registry, writing Run-key persistence only around shutdown or reboot, and deleting dropped components after execution on the next boot. Researchers also detailed anti-analysis checks for Windows Defender, Sandboxie, analyst tooling, VMware artifacts, RAM heuristics, and CPUID-based virtualization detection, alongside encrypted resources and string tables that hide campaign IDs and C2 infrastructure. To counter that obfuscation, defenders published tooling and workflows to recover QakBot configurations, strings, embedded payloads, and RC4- or AES-protected data at scale, including extractors for PE resources, memory-carving approaches for injected payloads, and Binary Ninja automation that recovered campaign data and live C2 endpoints from 64-bit samples.
Aug 15, 2026