Qakbot levels up with new obfuscation techniques
Summary: Cisco Talos reports that Qakbot, a banking trojan active since 2008, has updated its scheduled-task persistence mechanism so the malicious executable is downloaded as obfuscated data split across two .zzz files, then decrypted and reassembled with the type command. Talos first saw a spike in requests to the hijacked domains on April 2, 2019, coinciding with DNS changes on March 19, 2019 and a "CHANGES 15.03.19" comment in the JavaScript downloader.
What's compelling: Detection focused on seeing the full transfer of the malicious executable would likely miss this version, because the Qakbot binary arrives obfuscated and split across two files before being reassembled on the victim machine.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026