Qakbot Dropper Analysis

AhmedS Kasmani analyzes the Qakbot malware dropper, tracing the infection flow from HTML smuggling to DLL side-loading.

In this video we analyze the Qakbot Malware Dropper. The file that starts the infection is an HTML File, the flow is as follows: - html drops .zip via html smuggling. - zip contains iso file. - iso contains .lnk. - Lnk file launches calc.exe, - calc.exe sideloads windowscodecs.dll - windowscodecs.dll executes the malicious payload dll (102755.dll). Malware Sample: hxxps[://]bazaar[.]abuse[.]ch/sample/f5c16248418a4f1fd8dff438b26b8da7f587b77db9e180a82493bae140893687/ Malware Analysis Course Link: courses.null-char.com/courses/the-art-of-malware-analysis Academy Link: ask-academy.live/ Please provide feedback in the comments. To continue the conversation hit me up on twitter: 🐦 Twitter - twitter.com/nu11charb #malware #Qakbot #HTMLSmuggling #DLLSideLoading #reverseengineering