QakBot

First seen

2007-01-01 00:00:00

Malware type

credential-stealer, trojan, loader

Family

Malware family

Operating systems

windows

Related IoCs

49306 (36167 malicious)

Last IoC activity

2026-09-02 04:25:36

Profile updated

2026-07-07 12:39:01

Targeted industries: financial-services healthcare-and-pharmaceutical government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:us country_code:gb country_code:ca country_code:de country_code:au

Context

QakBot is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. QakBot is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware, most notably ProLock and Egregor.

Recent IoC activity

36,213 malicious indicators in Maltiverse are attributed to QakBot (S0650). The 20 most recently updated:

Detection coverage

• 11 YARA rules
• 989 Sigma rules

Malware & tools used

• Regsvr32 (attack-pattern)
• Hidden Files and Directories (attack-pattern)
• System Checks (attack-pattern)
• Remote System Discovery (attack-pattern)
• Data from Local System (attack-pattern)
• External Proxy (attack-pattern)
• PowerShell (attack-pattern)
• Windows Command Shell (attack-pattern)
• Security Software Discovery (attack-pattern)
• Native API (attack-pattern)
• Binary Padding (attack-pattern)
• Windows Service (attack-pattern)
• Domain Generation Algorithms (attack-pattern)
• Disable or Modify Tools (attack-pattern)
• File and Directory Discovery (attack-pattern)
• Registry Run Keys / Startup Folder (attack-pattern)
• Fileless Storage (attack-pattern)
• Masquerade File Type (attack-pattern)
• Network Share Discovery (attack-pattern)
• Process Hollowing (attack-pattern)
• JavaScript (attack-pattern)
• Msiexec (attack-pattern)
• Deobfuscate/Decode Files or Information (attack-pattern)
• Local Email Collection (attack-pattern)
• Malicious Link (attack-pattern)

Used by threat actors

• TA570 (threat-actor)
• TA575 (threat-actor)
• Storm-1811 (threat-actor)
• TA551 (threat-actor)
• TA577 (threat-actor)
• Pikabot Distribution Campaigns 2023 (campaign)
• QakBot January 2024 Campaign (campaign)
• Water Curupira Pikabot Distribution (campaign)

Exploited vulnerabilities

• CVE-2024-30051 (vulnerability)

Detection rules

• SIGNATURE_BASE_MAL_Qbot_HTML_Smuggling_Indicators_Oct22_1 (yara-rule)
• EMBEERESEARCH_Win_Qakbot_String_Decrypt_Nov_2022 (yara-rule)
• EMBEERESEARCH_Win_Qakbot_Api_Hashing_Oct_2022 (yara-rule)
• DITEKSHEN_MALWARE_Win_Qakbot (yara-rule)
• SIGNATURE_BASE_MAL_Qakbotloader_Export_Section_Feb23 (yara-rule)
• CAPE_Qakbot5 (yara-rule)
• CAPE_Qakbot4 (yara-rule)
• CAPE_Qakbotloader (yara-rule)
• CAPE_Qakbotantivm (yara-rule)
• CAPE_Qakbot5_1 (yara-rule)
• CAPE_Qakbot4_1 (yara-rule)

Reports & references

• pwc.co.uk — Pwc Cyber Threats 2020 A Year In Retrospect (report)
• CrowdStrike — Report2020Crowdstrikeglobalthreatreport (report)
• pwc.co.uk — Cyber Threats 2019 Retrospect (report)
• CrowdStrike — Report2021Gtr (report)
• CrowdStrike — Duck Hunting With Falcon Complete Analyzing A Fowl Banking Trojan Part 1 (report)
• secureworks.com — Gold Lagoon (report)
• Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
• proofpoint.com — First Step Initial Access Leads Ransomware (report)
• cloud.google.com — Unc4393 Goes Gently Into Silentnight (report)
• Microsoft — Threat Actors Misusing Quick Assist In Social Engineering Attacks Leading To Ransomware (report)
• Trend Micro — Rpt Navigating New Frontiers Trend Micro 2021 Annual Cybersecurity Report (report)
• blogs.blackberry.com — Kraken The Code On Prometheus (report)
• cisoclub.ru — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
• Microsoft — Microsoft Digital Defense Report 2020 September (report)
• i.blackhat.com — Eu 20 Clarke Its Not Finished The Evolving Maturity In Ransomware Operations Wp (report)
• i.blackhat.com — Eu 20 Clarke Its Not Finished The Evolving Maturity In Ransomware Operations (report)
• ibm.ent.box.com — Hs5Pcayhbbhjvj8Di5Sqdpbbd88Tsh89 (report)
• resources.malwarebytes.com — 2020 State Of Malware Report (report)
• securityintelligence.com — Sodinokibi Ransomware Incident Response Intelligence Together (report)
• Broadcom/Symantec — The Ransomware Threat September 2021 (report)
• web.archive.org — Otchet Kompanii Group Ib Ransomware Uncovered 2020 2021 (report)
• advanced-intel.com — From Qbot With Revil Ransomware Initial Attack Exposure Of Jbs (report)
• cert.ssi.gouv.fr — Certfr 2021 Cti 009 (report)
• cronup.com — De Ataque Con Malware A Incidente De Ransomware (report)
• pwc.co.uk — What Is Behind Ransomware Attacks Increase (report)

External references

• mitre-attack — S0650
• QuackBot
• Pinkslipbot
• QBot
• Kaspersky QakBot September 2021
• ATT QakBot April 2021
• Red Canary Qbot
• Trend Micro Qakbot December 2020
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy
• misp-galaxy