A recent QakBot malspam campaign is detected in which threat actors used fake replies to legitimate email chains along with DocuSign lures to target victims. Moreover, in late-November 2020, Qakbot underwent a version update. The campaign begins with malspam, having ZIP archive as attachments. Upon execution, an excel spreadsheet is extracted that contains embedded macros. When macros are enabled, communication with a malicious URL is established, that drops a DLL for Qakbot on target system.
Later, post-infection traffic on a vulnerable Windows host with Qakbot malware can be seen. Even with the version update, these spreadsheets distributing Qakbot have the same template we’ve seen for the past several months. Qakbot has been active for several years, and it continues to evolve. The latest version update has some significant changes, but infection traffic on vulnerable Windows hosts remains similar to what we’ve seen before with Qakbot. The Qbot botnet is using a new template for the distribution of their malware that uses a fake Windows Defender Antivirus theme to trick you into enabling Excel macros. Otherwise known as QakBot or QuakBot, Qbot is a Windows malware that steals bank credentials, Windows domain credentials, and provides remote access to threat actors who install ransomware. Victims usually become infected with Qbot through another malware infection or via phishing campaigns using various lures, including fake invoices, payment and banking information, scanned documents, or invoices.