QakBot

First seen

2007-01-01 00:00:00

Malware type

credential-stealer, trojan, loader

Family

Malware family

Operating systems

windows

Related IoCs

52102 (36787 malicious)

Last IoC activity

2026-10-17 04:23:33

Profile updated

2026-07-07 12:39:01

Targeted industries: financial-services healthcare-and-pharmaceutical government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:us country_code:gb country_code:ca country_code:de country_code:au

Context

QakBot is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. QakBot is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware, most notably ProLock and Egregor.

Recent IoC activity

36,781 malicious indicators in Maltiverse are attributed to QakBot (S0650). The 20 most recently updated:

Detection coverage

• 11 YARA rules
• 989 Sigma rules

Malware & tools used

• Regsvr32 (attack-pattern)
• Hidden Files and Directories (attack-pattern)
• System Checks (attack-pattern)
• Remote System Discovery (attack-pattern)
• Data from Local System (attack-pattern)
• External Proxy (attack-pattern)
• PowerShell (attack-pattern)
• Windows Command Shell (attack-pattern)
• Security Software Discovery (attack-pattern)
• Native API (attack-pattern)
• Binary Padding (attack-pattern)
• Windows Service (attack-pattern)
• Domain Generation Algorithms (attack-pattern)
• Disable or Modify Tools (attack-pattern)
• File and Directory Discovery (attack-pattern)
• Registry Run Keys / Startup Folder (attack-pattern)
• Fileless Storage (attack-pattern)
• Masquerade File Type (attack-pattern)
• Network Share Discovery (attack-pattern)
• Process Hollowing (attack-pattern)
• JavaScript (attack-pattern)
• Msiexec (attack-pattern)
• Deobfuscate/Decode Files or Information (attack-pattern)
• Local Email Collection (attack-pattern)
• Malicious Link (attack-pattern)

Used by threat actors

• Pikabot Distribution Campaigns 2023 (campaign)
• QakBot January 2024 Campaign (campaign)
• Water Curupira Pikabot Distribution (campaign)
• TA570 (threat-actor)
• TA575 (threat-actor)
• Storm-1811 (threat-actor)
• TA551 (threat-actor)
• TA577 (threat-actor)

Exploited vulnerabilities

• CVE-2024-30051 (vulnerability)

Detection rules

• SIGNATURE_BASE_MAL_Qbot_HTML_Smuggling_Indicators_Oct22_1 (yara-rule)
• CAPE_Qakbot5_1 (yara-rule)
• CAPE_Qakbot4_1 (yara-rule)
• CAPE_Qakbot5 (yara-rule)
• CAPE_Qakbot4 (yara-rule)
• CAPE_Qakbotloader (yara-rule)
• CAPE_Qakbotantivm (yara-rule)
• SIGNATURE_BASE_MAL_Qakbotloader_Export_Section_Feb23 (yara-rule)
• DITEKSHEN_MALWARE_Win_Qakbot (yara-rule)
• EMBEERESEARCH_Win_Qakbot_String_Decrypt_Nov_2022 (yara-rule)
• EMBEERESEARCH_Win_Qakbot_Api_Hashing_Oct_2022 (yara-rule)

Reports & references

• pwc.co.uk — Cyber Threats 2019 Retrospect (report)
• proofpoint.com — First Step Initial Access Leads Ransomware (report)
• Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
• raw.githubusercontent.com — When%20Ransomware%20Hits%20An%20Atm%20Giant%20 %20The%20Diebold%20Nixdorf%20Case%20Dissected%20 %20Group Ib%20Cybercrimecon2020 (report)
• group-ib.com — Prolock Evolution (report)
• hornetsecurity.com — Qakbot Malspam Leading To Prolock (report)
• hornetsecurity.com — Qakbot Reducing Its On Disk Artifacts (report)
• intrinsec.com — Egregor Prolock (report)
• intel471.com — Conti Emotet Ransomware Conti Leaks (report)
• research.nccgroup.com — Conti Nuation Methods And Techniques Observed In Operations Post The Leaks (report)
• truesec.com — Proxyshell Qbot And Conti Ransomware Combined In A Series Of Cyber Attacks (report)
• Broadcom/Symantec — Ransomware Hive Conti Avoslocker (report)
• info.spamhaus.com — Jan Jun%202024%20Botnet%20Threat%20Update (report)
• Trend Micro — Ssl Tls Technical Brief (report)
• threatresearch.ext.hp.com — Detecting Ta551 Domains (report)
• blog.group-ib.com — Prometheus Tds (report)
• resource.redcanary.com — 2021 Threat Detection Report (report)
• CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
• pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
• CrowdStrike — Duck Hunting With Falcon Complete Analyzing A Fowl Banking Trojan Part 1 (report)
• secureworks.com — Gold Lagoon (report)
• CrowdStrike — Report2021Gtr (report)
• cloud.google.com — Unc4393 Goes Gently Into Silentnight (report)
• Microsoft — Threat Actors Misusing Quick Assist In Social Engineering Attacks Leading To Ransomware (report)
• Trend Micro — Rpt Navigating New Frontiers Trend Micro 2021 Annual Cybersecurity Report (report)

External references

• mitre-attack — S0650
• QuackBot
• Pinkslipbot
• QBot
• Kaspersky QakBot September 2021
• ATT QakBot April 2021
• Red Canary Qbot
• Trend Micro Qakbot December 2020
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy