Procedure examples

QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.

QakBot has the ability to enumerate windows on a compromised host.

QakBot can use net config workstation, arp -a, `nslookup`, and ipconfig /all to gather network configuration information.

QakBot can measure the download speed on a targeted host.

QakBot can identify remote systems through the net view command.

QakBot has hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.

QakBot can use large file sizes to evade detection.

QakBot can encrypt and pack malicious payloads.

QakBot can make small changes to itself in order to change its checksum and hash value.

QakBot has been delivered in ZIP files via HTML smuggling.

QakBot can use obfuscated and encoded scripts.

QakBot can store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.

QakBot can identify the user name on a compromised system.

The QakBot payload has been disguised as a PNG file and hidden within LNK files using a Microsoft File Explorer icon.

QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.

QakBot can execute WMI queries to gather information.

QakBot can use netstat to enumerate current network connections.

QakBot has the ability to create scheduled tasks for persistence.

QakBot can inject itself into processes including explore.exe, Iexplore.exe, Mobsync.exe., and wermgr.exe.

QakBot can use process hollowing to execute its main payload.

QakBot can capture keystrokes on a compromised host.

QakBot has the ability to check running processes.

QakBot can use PowerShell to download and execute payloads.

QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.

QakBot can use VBS to download and execute malicious files.

The QakBot web inject module can inject Java Script into web banking pages visited by the victim.

QakBot can use net localgroup to enable discovery of local groups.

QakBot can delete folders and files including overwriting its executable with legitimate programs.

QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.

QakBot has stored stolen emails and other data into new folders prior to exfiltration.

QakBot can collect system information including the OS version and domain on a compromised host.

QakBot can identify whether it has been run previously on a host by checking for a specified folder.

QakBot has a module that can proxy C2 communications.

QakBot has the ability to use removable drives to spread through compromised networks.

QakBot has the ability use TCP to send or receive C2 packets.

QakBot has the ability to download additional components and malware.

QakBot can use GetProcAddress to help delete malicious strings from memory.

QakBot can conduct brute force attacks to capture credentials.

QakBot can modify the Registry to store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.

QakBot can target and steal locally stored emails to support thread hijacking phishing campaigns.

QakBot can identify peripheral devices on targeted systems.

QakBot can identify the system time on a targeted host.

QakBot can Base64 encode system information sent to C2.

QakBot can use net share to identify network shares for use in lateral movement.

QakBot can deobfuscate and re-assemble code strings for execution.

QakBot can use advanced web injects to steal web banking credentials.

QakBot has gained execution through users opening malicious links.

QakBot has gained execution through users opening malicious attachments.

QakBot can move laterally using worm-like functionality through exploitation of SMB.

QakBot can use MSIExec to spawn multiple cmd.exe processes.