Loading story…
Researchers analyzing QakBot v5.0 reported that the long-running malware family has added support for 64-bit Windows while preserving its role as a modular loader and information stealer. The examined sample, a 64-bit DLL seen in the wild in early February 2024, uses layered anti-analysis techniques including sandbox, emulator, process, and virtual machine checks, and relies on CRC32-based API hashing with an added XOR layer to obscure functionality. Analysts also found updated string handling in which an encrypted xor_key_blob is first decrypted before being used to recover embedded strings tied to execution paths, persistence, WMI queries, virtualization detection, security-product checks, and command execution.
The malware stores configuration data in the .data section and protects it with AES-based encryption, while its command-and-control traffic is sent over HTTP using AES-encrypted, Base64-encoded payloads. Recovered configuration details included the QakBot ID tchk08, flag 40=1, and a timestamp of 2024-01-31 21:22:34; analysts also extracted C2 endpoints at 31.210.173.10:443, 185.156.172.62:443, and 185.113.8.123:443. Beyond communications, QakBot v5.0 performs extensive host reconnaissance through WMI, Windows APIs, and shell commands, supports process hollowing, and maintains persistence through registry entries or scheduled tasks, underscoring its continued evolution as a stealthy post-compromise platform.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
The analyzed QakBot v5.0 sample was first seen in the wild on 2024-02-07 10:12:50 UTC. The sample is identified as a 64-bit Windows DLL associated with the updated QakBot codebase.
Decoded configuration data from the new 64-bit QakBot sample contained ID "tchk08," field "40=1," and a timestamp of 21:22:34 on 2024-01-31. This reflects a configuration/campaign timestamp recovered during analysis.
The QakBot v5 sample analyzed in the research was created as a 64-bit Windows DLL. One source gives the sample creation timestamp as 2024-01-29 13:43:37 UTC.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers across multiple security firms documented how **QakBot** (also known as **Qbot**) has evolved from a banking trojan into a stealthier modular malware platform that steals credentials, injects into processes such as `explorer.exe`, and can act as a loader for follow-on ransomware. Reports describe delivery through phishing documents, exploit droppers, and open shares, with campaigns targeting financial institutions in the United States and additional banks in Canada and the Netherlands. Analysts also observed persistent development activity, frequent packing changes, browser-injection capabilities, FTP exfiltration, DGA-based command-and-control behavior, and increasingly organized build practices designed to frustrate signature-based detection. More recent samples show QakBot reducing on-disk artifacts by storing configuration in the Windows Registry, writing Run-key persistence only around shutdown or reboot, and deleting dropped components after execution on the next boot. Researchers also detailed anti-analysis checks for Windows Defender, Sandboxie, analyst tooling, VMware artifacts, RAM heuristics, and CPUID-based virtualization detection, alongside encrypted resources and string tables that hide campaign IDs and C2 infrastructure. To counter that obfuscation, defenders published tooling and workflows to recover QakBot configurations, strings, embedded payloads, and RC4- or AES-protected data at scale, including extractors for PE resources, memory-carving approaches for injected payloads, and Binary Ninja automation that recovered campaign data and live C2 endpoints from 64-bit samples.
Aug 15, 2026
**Qakbot** has reappeared months after the law-enforcement-led Duck Hunt disruption, with researchers observing a new phishing campaign that targeted organizations in the hospitality sector. The activity used malicious PDF lures to deliver MSI installers containing a patched Internet Download Manager DLL and embedded Qakbot components, reviving a malware family long associated with credential theft, lateral movement, and follow-on ransomware operations. Analysis of the new samples showed Qakbot relying on `rundll32.exe`, Acrobat-themed decoy behavior, and process hollowing into `wermgr.exe` to run its final payload from memory while attempting to evade detection. Researchers also highlighted Qakbot's continued use of RC4-encrypted Windows Registry entries to store victim identifiers and command-and-control data, a technique documented in separate analysis focused on decrypting the malware's encrypted registry keys and tracking its persistent tradecraft.
Aug 15, 2026
QAKBOT resumed large-scale email spam activity after a roughly three-month pause, using hijacked email threads and malicious attachments to reestablish itself as an initial-access malware operation often seen before ransomware deployment. Researchers linked the activity to the distributor **TR**, which has also been associated with **SquirrelWaffle** delivery and reported **IMAP brute-force** operations, underscoring the role of spam-driven access brokers in broader intrusion chains. The renewed campaign introduced changes from earlier QAKBOT waves by combining **VBA macros** with **Excel 4.0 macros** in weaponized documents. The infection chain extracted embedded data, built a command to download a QAKBOT DLL from remote hosts, executed it through **`regsvr32.exe`** using the **`-silent`** parameter, and established persistence with a scheduled task. The malware has historically served as a precursor to ransomware incidents involving **MegaCortex, PwndLocker, Egregor, ProLock,** and **Sodinokibi/REvil**.
Aug 15, 2026