Kaspersky QakBot September 2021

QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.

QakBot can use net config workstation, arp -a, `nslookup`, and ipconfig /all to gather network configuration information.

QakBot can measure the download speed on a targeted host.

QakBot can identify remote systems through the net view command.

QakBot can identify the user name on a compromised system.

QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.

QakBot can execute WMI queries to gather information.

QakBot can use netstat to enumerate current network connections.

QakBot has the ability to create scheduled tasks for persistence.

QakBot can inject itself into processes including explore.exe, Iexplore.exe, Mobsync.exe., and wermgr.exe.

QakBot can capture keystrokes on a compromised host.

QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.

The QakBot web inject module can inject Java Script into web banking pages visited by the victim.

QakBot can use net localgroup to enable discovery of local groups.

QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.

QakBot has a module that can proxy C2 communications.

QakBot has the ability use TCP to send or receive C2 packets.

QakBot has the ability to download additional components and malware.

QakBot can conduct brute force attacks to capture credentials.

QakBot can target and steal locally stored emails to support thread hijacking phishing campaigns.

QakBot can identify the system time on a targeted host.

QakBot can Base64 encode system information sent to C2.

QakBot can use net share to identify network shares for use in lateral movement.

QakBot can deobfuscate and re-assemble code strings for execution.

QakBot can use advanced web injects to steal web banking credentials.

QakBot has gained execution through users opening malicious links.

QakBot has gained execution through users opening malicious attachments.

QakBot can run nltest /domain_trusts /all_trusts for domain trust discovery.

The QakBot dropper can delay dropping the payload to evade detection.

QakBot can identify the installed antivirus product on a targeted system.

QakBot has the ability to capture web session cookies.

QakBot has collected usernames and passwords from Firefox and Chrome.

QakBot has spread through emails with malicious attachments.

QakBot has spread through emails with malicious links.

The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.

QakBot can RC4 encrypt strings in C2 communication.