Backdoor.Qbot

Short bio

Backdoor.Qbot is Malwarebytes’ detection name for a large family of Backdoor Trojans that has been around in one form or another since 2009.

Type and source of infection

Backdoor.Qbot is mainly a banking Trojan and passwordstealer. It is worth noting that most varianst are VM-aware and some have polymorphic abilities.
Backdoor.Qbot main source are exploit kits but they are also spread by infected email attachments.

Aftermath

  • Data/information about the system may have been stolen
  • User credentials may have been stolen
  • Affected system may be susceptible to further attacks and/or infection due to a backdoor that was opened

Protection

Malwarebytes protects users from Backdoor.Qbot by using real-time protection.

block Backdoor.Qbot

Malwarebytes block Backdoor.Qbot

Business remediation

Malwarebytes can detect and remove Backdoor.Qbot on business machines without further user interaction.
To remove Backdoor.Qbot using Malwarebytes business products, follow the instructions below.

How to remove Backdoor.Qbot with Malwarebytes Endpoint Protection

  1. Go to the Malwarebytes Cloud console.
  2. To allow you to invoke a scan while the machine is off the network, go to Settings > Policies > your policy > General.
  3. Under Endpoint Interface Options, turn ON:
    1. Show Malwarebytes icon in notification area
    2. Allow users to run a Threat Scan (all threats will be quarantined automatically)
  4. Temporarily enable Anti-Rootkit scanning for all invoked threat scans.
    Go to Settings > Policies > your policy > Endpoint Protection > Scan Options
  5. Set Scan Rootkits to ON.
    MBEP prepare scan
  6. Once the endpoint has been updated with the latest policy changes:
    1. Take the client off the network
    2. From the system tray icon, run an Anti-Rootkit threat scan.
      MBEP start scan

If you have infected machines that are not registered endpoints in Malwarebytes Endpoint Protection, you can remove Backdoor.Qbot with our Breach Remediation tool (MBBR).

  1. Log into your My Account page and copy your license key. The key is needed to activate MBBR tool.
  2. Open your Cloud console.
  3. From a clean and safe machine, go to Endpoints > Add > Malwarebytes Breach Remediation. This will download the MBBR zip package.
  4. Unzip the package.
  5. Access a Windows command line prompt and issue the following commands:
    mbbr register –key:<prodkey>
    mbbr update
    Note: You must substitute your license key for <prodkey>.
  6. Copy the MBBR folder to a flash drive.
  7. From an infected, offline machine, copy the MBBR folder from the flash drive.
  8. Start a scan using the following command:
    mbbr scan –full –ark –remove –noreboot
  9. Refer to the Malwarebytes Breach Remediation Windows Administrator Guide for all supported scanning commands.

How to remove Backdoor.Qbot with Malwarebytes Endpoint Security

You can use Malwarebytes Anti-Malware v1.80, which is included in your Malwarebytes Endpoint Security deployment to scan and remove Backdoor.Qbot.

Option 1
  1. Remove the infected endpoint from the network.
  2. On the infected machine, right click the system tray icon and click on Start Scanner.
    MBES start scanner
  3. Select Perform full scan.
    MBES scan options
  4. Click on Scan button.
Option 2
  1. Open CMD
  2. CD to C:\Program Files (x86)\Malwarebytes’ Anti-Malware
  3. Run mbamapi /scan –full –remove -reboot

It is recommended to follow the MBAM scan with an Anti-Rootkit (MBAR) tool scan.

  1. From a safe computer, download the Anti-Rootkit tool.
    For detailed instructions, refer to the KB article How do I use Malwarebytes Anti-Rookit?
  2. Once Anti-Rootkit is updated (steps 1 – 4), copy it to a flash drive.
  3. Go to an infected machine that has been scanned/cleaned with Anti-Malware and is still off the network.
  4. Copy the Anti-Rootkit files from the flash drive to the machine.
  5. Turn off Anti-Malware. Right click the Anti-Malware system tray icon and select Exit.
  6. Run the Anti-Rootkit program to scan for threats. Refer to How do I use Malwarebytes Anti-Rookit? steps 5 – 12 for instructions.

Home remediation

Malwarebytes can detect and remove Backdoor.Qbot without further user interaction.

  1. Please download Malwarebytes to your desktop.
  2. Double-click mb3-setup-consumer-{version}.exe and follow the prompts to install the program.
  3. Then click Finish.
  4. Once the program has fully updated, select Scan Now on the Dashboard. Or select the Threat Scan from the Scan menu.
  5. If another update of the definitions is available, it will be implemented before the rest of the scanning procedure.
  6. When the scan is complete, make sure that all Threats are selected, and click Remove Selected.
  7. Restart your computer when prompted to do so.

IOCs

Backdoor.Qbot may install different files upon execution. It is usually installed in the folder %ALLUSERSPROFILE%, for example:

%ALLUSERSPROFILE% \Microsoft\oraene2
%ALLUSERSPROFILE% _qbothome_qbot.dll

but also

%APPDATA% \microsoft\jwkljxnw\jwkljx.dll
%APPDATA% \roaming\microsoft\jwkljxnw\jwkljxn.exe

Once installed, Backdoor.Qbot replaces existing registry data found in subkey “HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run” so that the malware runs at each Windows start. The malware prepends itself to a previously existing entry. For example, we have seen it create the following registry entry:

In subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: “<random characters>”
With data: “”%APPDATA%\microsoft\jwkljxnw\jwkljxn.exe”
It usually creates a mutex to ensure that only one instance of itself is running, for example:

enagk

Backdoor.Qbot attempts to connect to a remote server to receive command instructions from a threat actor. Commands may include any of the following actions:

Install additional files
Execute processes
Download updates
Log keystrokes
Steal passwords from MSN, Internet Explorer, and Outlook
Get system information
Monitor several Web sites, some of which are related to banks and other financial institutions
Steal cookies and certificates
Downloads other malware

Backdoor.Qbot may connect to remote sites to download updates or additional malware, which are then installed in the computer.

Some of the domains it is known to connect to are:

nt11.co.in
nt002.cn

Cybersecurity info you can't do without

Want to stay informed on the latest news in cybersecurity? Sign up for our newsletter and learn how to protect your computer from threats.

Select your language