Backdoor.Qbot is Malwarebytes’ detection name for a large family of Backdoor Trojans that has been around in one form or another since 2009.
Backdoor.Qbot is mainly a banking Trojan and passwordstealer. It is worth noting that most varianst are VM-aware and some have polymorphic abilities.
Backdoor.Qbot main source are exploit kits but they are also spread by infected email attachments.
Malwarebytes protects users from Backdoor.Qbot by using real-time protection.
You can use the Malwarebytes Anti-Malware Nebula console to scan endpoints.
Choose the Scan + Quarantine option. Afterwards you can check the Detections page to see which threats were found.
On the Quarantine page you can see which threats were quarantined and restore them if necessary.
Malwarebytes can detect and remove Backdoor.Qbot without further user interaction.
Backdoor.Qbot may install different files upon execution. It is usually installed in the folder %ALLUSERSPROFILE%, for example:
Once installed, Backdoor.Qbot replaces existing registry data found in subkey “HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run” so that the malware runs at each Windows start. The malware prepends itself to a previously existing entry. For example, we have seen it create the following registry entry:
In subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
Sets value: “<random characters>”
With data: “”%APPDATA%\microsoft\jwkljxnw\jwkljxn.exe”
It usually creates a mutex to ensure that only one instance of itself is running, for example:
Backdoor.Qbot attempts to connect to a remote server to receive command instructions from a threat actor. Commands may include any of the following actions:
Install additional files
Steal passwords from MSN, Internet Explorer, and Outlook
Get system information
Monitor several Web sites, some of which are related to banks and other financial institutions
Steal cookies and certificates
Downloads other malware
Backdoor.Qbot may connect to remote sites to download updates or additional malware, which are then installed in the computer.
Some of the domains it is known to connect to are:
Select your language