Qakbot Dropper Analysis
HTML-код
- Опубликовано: 22 авг 2024
- In this video we analyze the Qakbot Malware Dropper. The file that starts the infection is an HTML File, the flow is as follows:
- html drops .zip via html smuggling.
- zip contains iso file.
- iso contains .lnk.
- Lnk file launches calc.exe,
- calc.exe sideloads windowscodecs.dll
- windowscodecs.dll executes the malicious payload dll (102755.dll).
Malware Sample: hxxps[://]bazaar[.]abuse[.]ch/sample/f5c16248418a4f1fd8dff438b26b8da7f587b77db9e180a82493bae140893687/
Malware Analysis Course Link: courses.null-c...
Academy Link: ask-academy.live/
Please provide feedback in the comments.
To continue the conversation hit me up on twitter:
🐦 Twitter - / nu11charb
#malware #Qakbot #HTMLSmuggling #DLLSideLoading #reverseengineering
Great video. I wish there was a course for beginners on how to do this. So helpful.
There is a Malware Analysis course by me on how do this. Check the description there is link for my course.
Great analysis as always. Looking forward for part 2 :)
amazing as always :) thanks for uploading this, hope you are well!
keep going great explanation
Many thanks
thank you good sir
شكرآ ا تحليل جيد
Nice explanation. Thank you for sharing!
hey great explanation but i wanted to know whats the final payload dll have impact on the system? or just a sideloading
Great video!
Thanks a lot legend 🙂
Thanks Bruu
Thanks for the video, great job!
You are most welcome
Hi ahmed, how can we perform the analysis on .dat file instaed of calc.exe. New qakbot are coming .dat file inside the ISO image
Genius!!
Nice video!
Thanks Colin
Are there any chances for zuorat malware analysis Sir?