Backdoor.Qbot is Malwarebytes’ detection name for a large family of Backdoor Trojans that has been around in one form or another since 2009.
Backdoor.Qbot is mainly a banking Trojan and passwordstealer. It is worth noting that most varianst are VM-aware and some have polymorphic abilities.
Backdoor.Qbot main source are exploit kits but they are also spread by infected email attachments.
Malwarebytes protects users from Backdoor.Qbot by using real-time protection.
Malwarebytes can detect and remove Backdoor.Qbot on business machines without further user interaction.
To remove Backdoor.Qbot using Malwarebytes business products, follow the instructions below.
If you have infected machines that are not registered endpoints in Malwarebytes Endpoint Protection, you can remove Backdoor.Qbot with our Breach Remediation tool (MBBR).
You can use Malwarebytes Anti-Malware v1.80, which is included in your Malwarebytes Endpoint Security deployment to scan and remove Backdoor.Qbot.
It is recommended to follow the MBAM scan with an Anti-Rootkit (MBAR) tool scan.
Malwarebytes can detect and remove Backdoor.Qbot without further user interaction.
Backdoor.Qbot may install different files upon execution. It is usually installed in the folder %ALLUSERSPROFILE%, for example:
Once installed, Backdoor.Qbot replaces existing registry data found in subkey “HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run” so that the malware runs at each Windows start. The malware prepends itself to a previously existing entry. For example, we have seen it create the following registry entry:
In subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: “<random characters>”
With data: “”%APPDATA%\microsoft\jwkljxnw\jwkljxn.exe”
It usually creates a mutex to ensure that only one instance of itself is running, for example:
Backdoor.Qbot attempts to connect to a remote server to receive command instructions from a threat actor. Commands may include any of the following actions:
Install additional files
Steal passwords from MSN, Internet Explorer, and Outlook
Get system information
Monitor several Web sites, some of which are related to banks and other financial institutions
Steal cookies and certificates
Downloads other malware
Backdoor.Qbot may connect to remote sites to download updates or additional malware, which are then installed in the computer.
Some of the domains it is known to connect to are: