Procedure examples

QakBot can use Regsvr32 to execute malicious DLLs.

QakBot has used Rundll32.exe to drop malicious DLLs including Brute Ratel C4 and to enable C2 communication.

QakBot can run nltest /domain_trusts /all_trusts for domain trust discovery.

QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found.

The QakBot dropper can delay dropping the payload to evade detection.

QakBot can enumerate a list of installed programs.

QakBot can identify the installed antivirus product on a targeted system.

QakBot has the ability to capture web session cookies.

QakBot can remotely create a temporary service on a target host.

QakBot can maintain persistence by creating an auto-run Registry key.

QakBot can use signed loaders to evade detection.

QakBot has been packaged in ISO files in order to bypass Mark of the Web (MOTW) security measures.

QakBot has collected usernames and passwords from Firefox and Chrome.

QakBot has placed its payload in hidden subdirectories.

QakBot has spread through emails with malicious attachments.

QakBot has spread through emails with malicious links.

QakBot can use domain generation algorithms in C2 communication.

The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.

QakBot can RC4 encrypt strings in C2 communication.

QakBot has the ability to use DLL side-loading for execution.

QakBot has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list.