Loading malware…
QakBot, also widely known as QuakBot or Qbot, is a long-running modular Windows banking trojan that evolved into a multifunctional intrusion platform used for credential theft, internal propagation, post-compromise reconnaissance, and staging of follow-on payloads including Cobalt Strike and ransomware. Active since at least 2007, it has been associated with financially motivated operations and has remained prominent in enterprise intrusions as well as banking-focused campaigns.
QakBot is commonly delivered through phishing and malspam campaigns, including emails carrying ZIP archives or weaponized Microsoft Office documents that rely on user interaction and malicious macros. It has also been distributed by other malware, including Emotet. In observed campaigns, malicious Excel documents used Excel 4.0 macros and sometimes protected VBA to download additional payloads and execute them through signed Windows utilities such as regsvr32.
On infected systems, QakBot operates as a modular payload with capabilities extending beyond banking fraud. Reported behaviors include downloading and executing additional components, process injection into legitimate Windows processes, persistence via scheduled tasks and Run-key mechanisms, and defense evasion through actions such as adding Windows Defender exclusions. It has also been observed stealing Outlook credentials and using compromised email access to support internal spearphishing. Reconnaissance activity includes host, network, and Active Directory discovery using native commands and tools such as AdFind.
QakBot has been used to facilitate lateral movement in enterprise environments, including abuse of remote services and administrative shares to execute payloads on other hosts. Operators have also been observed deploying Cobalt Strike after QakBot infection for broader post-exploitation activity. In some intrusions, exploitation of PrintNightmare (CVE-2021-34527) was used to obtain SYSTEM-level execution. QakBot activity has been linked to data exfiltration objectives and to ransomware staging and delivery, including prior associations with REvil and Egregor.
The malware also appears in studies of encrypted command-and-control traffic, where QuakBot infrastructure has been observed using self-signed TLS certificates with anomalous certificate characteristics. This reflects its mature command-and-control tradecraft and the family’s continued adaptation over time.
QakBot primarily targets Windows systems and is best characterized as a banking trojan that expanded into a broader enterprise intrusion malware ecosystem.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
We found that Quakbot threat actors exploited the PrintNightmare vulnerability (CVE-2021-34527 – “Windows Print Spooler Remote Code Execution”) in the later stages of the attack to perform privileged file operations and code execution via the Windows Print Spooler service. | Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
This led us to suspect that ProxyLogon and ProxyShell vulnerabilities are being exploited. These vulnerabilities allow Quakbot threat actors to bypass email security policies and propagate Quakbot infections. ProxyLogon – CVE-2021-26855, CVE-2021-27065 | Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
This led us to suspect that ProxyLogon and ProxyShell vulnerabilities are being exploited. These vulnerabilities allow Quakbot threat actors to bypass email security policies and propagate Quakbot infections. ProxyShell – CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 | Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
This led us to suspect that ProxyLogon and ProxyShell vulnerabilities are being exploited. These vulnerabilities allow Quakbot threat actors to bypass email security policies and propagate Quakbot infections. ProxyLogon – CVE-2021-26855, CVE-2021-27065 | Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
This led us to suspect that ProxyLogon and ProxyShell vulnerabilities are being exploited. These vulnerabilities allow Quakbot threat actors to bypass email security policies and propagate Quakbot infections. ProxyShell – CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 | Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
This led us to suspect that ProxyLogon and ProxyShell vulnerabilities are being exploited. These vulnerabilities allow Quakbot threat actors to bypass email security policies and propagate Quakbot infections. ProxyShell – CVE-2021-34473, CVE-2021-34523, CVE-2021-31207 | Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
MalwareBazaar pivot analysis ties this sample to a broader campaign cluster exploiting CVE-2025-8088 (WinRAR)... Second, CVE-2025-8088 (a WinRAR vulnerability) appears in three related samples from March 3-10. The password-protected RAR in our sample may be designed to exploit this same vulnerability during extraction. Without the password, we cannot confirm this -- but the pattern is suggestive.
Miscreants have been seen exploiting the Follina flaw, tracked as CVE-2022-30190, in the Windows Support Diagnostic Tool to deliver Qbot... Follina is a remote code execution (RCE) vulnerability in the Microsoft Support Diagnostic Tool; this can be exploited by getting an application, such as Word, to call out to the tool from a specially crafted document when opened.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Quakbot (also known as Qabot or Qbot) is a modular Banking Trojan, active since the end of 2007.
The March 3 sample tagged UAC-0252 provides a tentative attribution anchor... 2026-03-03 27d7a398... ZIP UKR, Quakbot, RClone-Stealer-Mega Algeria-Ukraine cooperation
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Qakbot also creates a fake persistence which is scheduled tasks to deceive us.
these templates use Excel 4.0 macros ... automatically run macros when victim press “ Enable Content ” button.
Qakbot also creates a fake persistence which is scheduled tasks to deceive us.
Qakbot also applied encryption techniques to conceal information, as well as encrypt the payload on memory.
In malware, we often see threat actors that tend to obfuscate or encrypt their code in order to slow down the analysis of security researchers... many authors tend to use open-source packers but also craft their own custom packers.
This technique is called Stack-Strings and will appear several times during the Qbot unpacking process.
Payload will find the address of the API functions through lookup a pre-computed hash based on the API function name.
In both cases, the Quakbot execution flow executes the regsvr32 process three times in order to load masqueraded DLL payloads (test, good, random).
Qakbot select which process to inject its unpacked code ... Copy the entire Qakbot payload to the memory created above ... overwrite the explorer.exe’s entry point
Qakbot does overwrite null bytes on the payload itself on disk ... Delete payload on disk.
all strings are encrypted and decrypted at runtime into memory only and destroyed right afterwards.
If successfully download one of the above payloads, it will use rundll32.exe to execute
Payload checks whether its name is in the blacklist ... checks whether the running processes are in the blacklist ... check with the blacklist included: A3E64E55_pr;VboxVideo;Red Hat VirtIO;QEMU.
Use API functions of kernel32 are FindResourceA; SizeofResource; LoadResource to load the data stored in this resource ...
payload uses the functions CreateToolhelp32Snapshot; Process32First; Process32Next to enumerate all the processes running on the victim machine
Payload uses API functions SetupDiGetClassDevsA, SetupDiEnumDeviceInfo, SetupDiGetDeviceRegistryPropertyA ... get information about the device on the system
Over the last six years there has been an increased shift by malware authors to secure their C&C communications using the SSL/TLS protocol to stymie detection and blend in with normal traffic.
112 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Appears only in navigation/related content, not part of the main reference.
A modular banking trojan that steals credentials, financial information, browser data, and Outlook passwords; it spreads via phishing emails and weaponized Excel documents, uses regsvr32 and process injection for execution and persistence, performs discovery and lateral movement, deploys Cobalt Strike, and has been observed preceding ransomware deployment.
Referenced as a malware family found in a related campaign sample within the broader Ukraine-targeting cluster; the analyzed BES PDF lure itself did not reveal its final payload.
A tertiary malware tool observed as a single LNK sample associated with the same infrastructure as the main operation.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.