Detecting QAKBOT/QBOT Malicious Activity

Qakbot (Qbot) has been around for over a decade, and can routinely be found on lists of the most common malware infections. From the attacker's perspective, a lot of this success can be attributed to rapidly changing their TTPs to avoid detection, packaging their malware in new and novel ways to evade anti-virus, EDR, and SIEM detections rules. In this week's SnapShot, we'll take a look at a recent Qakbot sample, highlight some of their evasion strategies (like adding multiple backslashes to file paths), and discuss detection and hunting strategies you can use to keep ahead of their ever changing techniques.

References:

SnapAttack Content:

[prophead]

this is a great representation of WHAT this thing is ....well done!
NOW ....how the hell do you get rid of it