Qakbot Distributed via OneNote and CHM

AhnLab Security Emergency response Center (ASEC) has covered various distribution methods of Qakbot, and the method of distributing through OneNote was covered back in February. The distribution of Qakbot through OneNote has been confirmed again recently, and it was discovered that the Windows Help file (CHM) was used in this recent attack.

Qakbot Being Distributed via OneNote

Upon executing the OneNote file, it prompts users to click on the Open button along with a Microsoft Azure image, as shown below. …

ahnlab asec attack back center chm distributed distribution emergency february file malware analysis onenote qakbot response security windows