Writing a Qakbot 5.0 config extractor with Malcat

Starting from a (backdoored) MSI installer, we will unroll the infection to chain to get the final Qakbot sample. Sticking to pure static analysis, we will then decrypt Qakbot's configuration and finally write a script in Malcat to automate the process.

Article Link: Writing a Qakbot 5.0 config extractor with Malcat

1 post - 1 participant

Read full topic

analysis article config configuration decrypt infection installer link malware analysis msi process qakbot sample script static analysis writing