Trend Micro Qakbot May 2020

QakBot can use large file sizes to evade detection.

QakBot has the ability to create scheduled tasks for persistence.

QakBot can inject itself into processes including explore.exe, Iexplore.exe, Mobsync.exe., and wermgr.exe.

QakBot can use VBS to download and execute malicious files.

QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.

QakBot has the ability to use removable drives to spread through compromised networks.

QakBot has the ability to download additional components and malware.

QakBot can identify peripheral devices on targeted systems.

QakBot can use net share to identify network shares for use in lateral movement.

QakBot has gained execution through users opening malicious links.

QakBot has gained execution through users opening malicious attachments.

QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found.

QakBot can maintain persistence by creating an auto-run Registry key.

QakBot has spread through emails with malicious attachments.

QakBot has spread through emails with malicious links.

QakBot can use domain generation algorithms in C2 communication.