Qakbot Dropper Analysis

In this video we analyze the Qakbot Malware Dropper. The file that starts the infection is an HTML File, the flow is as follows:
- html drops .zip via html smuggling.
- zip contains iso file.
- iso contains .lnk.
- Lnk file launches calc.exe,
- calc.exe sideloads windowscodecs.dll
- windowscodecs.dll executes the malicious payload dll (102755.dll).
Malware Sample: hxxps[://]bazaar[.]abuse[.]ch/sample/f5c16248418a4f1fd8dff438b26b8da7f587b77db9e180a82493bae140893687/
Malware Analysis Course Link: courses.null-c...
Academy Link: ask-academy.live/
Please provide feedback in the comments.
To continue the conversation hit me up on twitter:
🐦 Twitter - / nu11charb
#malware #Qakbot #HTMLSmuggling #DLLSideLoading #reverseengineering

[@rizwanmehboob4725]

Great analysis as always. Looking forward for part 2 :)

[@dsosa23]

Great video. I wish there was a course for beginners on how to do this. So helpful.

[@ahmedskasmani]

There is a Malware Analysis course by me on how do this. Check the description there is link for my course.

[@0xca733]

amazing as always :) thanks for uploading this, hope you are well!

[@0fzex003]

keep going great explanation

[@ahmedskasmani]

Many thanks

[@vikalpdutttripathi]

Nice explanation. Thank you for sharing!

[@MakkiMohammedymailcom]

thank you good sir

[@c3rb3ru5d3d53c]

Great video!

[@ahmedskasmani]

Thanks a lot legend 🙂

[@MalwareHunter_07]

hey great explanation but i wanted to know whats the final payload dll have impact on the system? or just a sideloading

[@ahmedhassane2369]

شكرآ ا تحليل جيد

[@Dchmielewski09]

Thanks for the video, great job!

[@ahmedskasmani]

You are most welcome

[@hindimoviesindia3477]

Thanks Bruu

[@Giscardyoryor]

Genius!!

[@cybercdh]

Nice video!

[@ahmedskasmani]

Thanks Colin

[@jilinmr3092]

Hi ahmed, how can we perform the analysis on .dat file instaed of calc.exe. New qakbot are coming .dat file inside the ISO image

[@dawidp7094]

Are there any chances for zuorat malware analysis Sir?