Loading story…
Elastic Security Labs documented Qbot/QakBot (also known as QBOT), a long-running modular Windows banking trojan used by multiple threat actors and ransomware affiliates. In the analyzed activity, the malware executed as a DLL through the legitimate Windows regsvr32.exe utility, used cmd.exe and curl.exe, injected into explorer.exe, copied itself into a randomly named directory beneath the user AppData path, and established persistence through Registry Run keys and scheduled tasks intended to run with SYSTEM privileges.
Qbot used anti-analysis and defense-evasion checks to identify sandbox, monitoring, and security products, and could add its persistence location to Microsoft Defender exclusions when Defender was present. It avoided execution on systems configured for Russian and several Eastern European, Central Asian, and Caucasus-region languages. The malware communicated with a distributed C2 network over HTTP or TLS using encrypted, Base64-encoded JSON, enabling operators to deliver updates, execute shell or PowerShell commands, and inject or launch additional binaries; Elastic identified 138 associated IP addresses and linked the infrastructure to hundreds of malicious files.
Get the actors, campaigns, and ATT&CK mapping behind it.
6 events from the most recent confirmed update back to the earliest known activity.
A 2022 QBOT V4 campaign used a multi-stage Windows DLL launched through regsvr32, process injection, Registry and filesystem persistence, SYSTEM-level scheduled-task execution, and encrypted HTTP/TLS command-and-control.
Elastic first observed QBOT in its dataset on November 28, 2020. It reported that shared infrastructure use shifted beginning that month, with QBOT DLLs comprising 97.1% of samples first seen after November 2020.
QBOT, also known as QAKBOT, began operating as a modular banking trojan and was later adopted broadly by threat actors and ransomware groups.
Dynamic and static analysis identified 138 QBOT-associated IP addresses, which Elastic linked to 339 additional malicious files. The associated samples included predominantly QBOT Win32 DLLs, EMOTET-associated executables, and malicious-spam Office attachments.
The analyzed QBOT sample injected into explorer.exe, copied itself into the user's AppData directory, created Registry Run-key persistence, and created a scheduled task to run regsvr32.exe as NT AUTHORITY\SYSTEM.
Elastic tracked REF3726 activity in which an initial cmd.exe chain tested connectivity, created C:\vyr, used curl.exe to download a disguised payload, and executed it with regsvr32.exe. Elastic Endpoint Security blocked the initial infection, after which researchers manually detonated the QBOT DLL for analysis.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers across multiple security firms documented how **QakBot** (also known as **Qbot**) has evolved from a banking trojan into a stealthier modular malware platform that steals credentials, injects into processes such as `explorer.exe`, and can act as a loader for follow-on ransomware. Reports describe delivery through phishing documents, exploit droppers, and open shares, with campaigns targeting financial institutions in the United States and additional banks in Canada and the Netherlands. Analysts also observed persistent development activity, frequent packing changes, browser-injection capabilities, FTP exfiltration, DGA-based command-and-control behavior, and increasingly organized build practices designed to frustrate signature-based detection. More recent samples show QakBot reducing on-disk artifacts by storing configuration in the Windows Registry, writing Run-key persistence only around shutdown or reboot, and deleting dropped components after execution on the next boot. Researchers also detailed anti-analysis checks for Windows Defender, Sandboxie, analyst tooling, VMware artifacts, RAM heuristics, and CPUID-based virtualization detection, alongside encrypted resources and string tables that hide campaign IDs and C2 infrastructure. To counter that obfuscation, defenders published tooling and workflows to recover QakBot configurations, strings, embedded payloads, and RC4- or AES-protected data at scale, including extractors for PE resources, memory-carving approaches for injected payloads, and Binary Ninja automation that recovered campaign data and live C2 endpoints from 64-bit samples.
Aug 15, 2026
Multiple incident reports describe **Qakbot** infections delivered through phishing emails that linked to ZIP archives containing malicious Excel files, often using Excel 4.0 macros to fetch DLL payloads. On compromised Windows systems, the malware executed downloaded DLLs with `regsvr32.exe`, contacted multiple command-and-control servers, and in some cases used distribution tags such as **`obama166`** and **`aa`**. Researchers observed Qakbot storing artifacts on disk, changing persistence behavior compared with earlier variants, and in broader campaigns stealing Outlook credentials, adding Windows Defender exclusions, and using internal email threads to spread further inside organizations. Follow-on activity showed operators deploying **Cobalt Strike** and VNC-based remote access, including **DarkVNC** traffic over TCP 443 and VNC beaconing detected after the initial compromise. In one analyzed case, Cobalt Strike and VNC activity appeared about 17 hours after infection, indicating a second-stage intrusion after Qakbot established foothold. Additional reporting ties these intrusions to hands-on-keyboard actions such as reconnaissance, lateral movement over SMB admin shares, service-based persistence, and preparation for ransomware deployment, while one campaign also reportedly abused **PrintNightmare** (`CVE-2021-34527`) for SYSTEM-level execution and may have leveraged **ProxyLogon** and **ProxyShell** to help distribute malicious emails in enterprise environments.
Aug 15, 2026
Researchers analyzing **QakBot v5.0** reported that the long-running malware family has added support for **64-bit Windows** while preserving its role as a modular loader and information stealer. The examined sample, a 64-bit DLL seen in the wild in early February 2024, uses layered anti-analysis techniques including sandbox, emulator, process, and virtual machine checks, and relies on **CRC32-based API hashing** with an added XOR layer to obscure functionality. Analysts also found updated string handling in which an encrypted `xor_key_blob` is first decrypted before being used to recover embedded strings tied to execution paths, persistence, WMI queries, virtualization detection, security-product checks, and command execution. The malware stores configuration data in the `.data` section and protects it with **AES-based encryption**, while its command-and-control traffic is sent over **HTTP** using AES-encrypted, Base64-encoded payloads. Recovered configuration details included the QakBot ID **`tchk08`**, flag **`40=1`**, and a timestamp of **2024-01-31 21:22:34**; analysts also extracted C2 endpoints at **`31.210.173.10:443`**, **`185.156.172.62:443`**, and **`185.113.8.123:443`**. Beyond communications, QakBot v5.0 performs extensive host reconnaissance through WMI, Windows APIs, and shell commands, supports process hollowing, and maintains persistence through registry entries or scheduled tasks, underscoring its continued evolution as a stealthy post-compromise platform.
Aug 15, 2026