Crowdstrike Qakbot October 2020

QakBot can use net config workstation, arp -a, `nslookup`, and ipconfig /all to gather network configuration information.

QakBot can identify remote systems through the net view command.

QakBot can make small changes to itself in order to change its checksum and hash value.

QakBot has the ability to create scheduled tasks for persistence.

QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.

QakBot can use VBS to download and execute malicious files.

QakBot can delete folders and files including overwriting its executable with legitimate programs.

QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.

QakBot can collect system information including the OS version and domain on a compromised host.

QakBot has the ability to download additional components and malware.

QakBot can conduct brute force attacks to capture credentials.

QakBot can Base64 encode system information sent to C2.

QakBot has gained execution through users opening malicious attachments.

QakBot can move laterally using worm-like functionality through exploitation of SMB.

QakBot can use MSIExec to spawn multiple cmd.exe processes.

QakBot has used Rundll32.exe to drop malicious DLLs including Brute Ratel C4 and to enable C2 communication.

QakBot can identify the installed antivirus product on a targeted system.

QakBot can maintain persistence by creating an auto-run Registry key.