Qbot

Overview

Executive Summary

Infection Vector and Technical Capabilities

• Advanced Evasion and Anti-Analysis: Qbot is heavily packed and employs numerous anti-VM and anti-sandbox checks. It frequently utilizes "living off the land" techniques, using legitimate Windows binaries (like `regsvr32.exe` or `wscript.exe`) to execute its payload, severely complicating EDR detection.
• Aggressive Lateral Movement: Once active, Qbot immediately begins mapping the internal network. It steals credentials using Mimikatz-like modules, enumerates Active Directory, and attempts to move laterally via SMB (Server Message Block) utilizing stolen admin credentials or exploiting known vulnerabilities.
• The Ransomware Precursor: Qbot's ultimate goal in modern campaigns is total domain compromise. Once it has secured domain admin privileges and mapped the network, the operators sell this access to ransomware syndicates, who use the Qbot infrastructure to push ransomware encryptors to every machine on the network simultaneously.

Threat Assessment

Incident Response and Remediation

• Declare a Major Incident: Engage specialized, third-party Incident Response (IR) teams immediately. Isolate affected endpoints, but do not reboot them, to preserve critical memory forensics needed to understand the scope of the lateral movement.
• Active Directory Lockdown: The immediate threat is lateral movement and domain compromise. IR teams must hunt for anomalous admin logins, reset krbtgt account passwords (twice), and scrutinize Domain Admin account activity.
• Enterprise-Wide Eradication: Remediating Qbot requires a highly coordinated, network-wide effort to identify all compromised hosts, sever all C2 connections, and rebuild affected machines from known-good baselines. Removing a single Qbot endpoint is insufficient, as the malware will simply re-infect it from another compromised host on the LAN.

Known aliases

Threat reports may refer to this family under multiple names:

• Trojan.Qbot
• Banking.Qakbot
• Win32/Qakbot

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure.

Delivery vectors

• HTML smuggling attachments
• ISO/IMG containers with LNK files
• OneNote files dropping HTA

Network indicators

• TLS to compromised residential IPs acting as C2 proxies
• Beaconing every 30-60 seconds with hard-coded ports 443, 995, 2222

Persistence mechanisms

• Scheduled task with random GUID name
• DLL sideloading via legitimate signed binaries

Detection Guidance

Detection ideas drawn from public reporting. Tune to your environment before deploying.

• YARA rules from CISA Qakbot advisory
• Sysmon detections for regsvr32.exe loading DLL from %APPDATA%
• EDR rule for explorer.exe injecting into msra.exe or mobsync.exe

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_QBOT {
    meta:
        description = "Detects Qbot (banking_trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "qbot" ascii wide nocase
        $s2 = "trojan.qbot" ascii wide nocase
        $s3 = "banking.qakbot" ascii wide nocase
        $s4 = "win32/qakbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Qbot Activity
id: d9b8af17f349af0718badc314ce6b4bd
status: experimental
description: Detects generic indicators of the qbot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*qbot*"
            - "*trojan.qbot*"
            - "*banking.qakbot*"
            - "*win32/qakbot*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Run FBI-distributed Qakbot uninstaller (where applicable per the 2023 takedown)
2. Isolate the host and block C2 IP ranges
3. Rotate credentials in browser stores and email clients on host
4. Hunt for Cobalt Strike beacons and follow-on ransomware staging

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely solely on AV signatures; Qbot updates frequently
2. Do not restore from backups without verifying the backup pre-dates infection
3. Do not ignore email reply-chain hijacking — notify recipients

References & External Analysis

• MITRE ATT&CK: QakBot (S0650)
• Search "qbot" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: banking_trojan)

Explore other malware families in the same category:

• Zusy
• Zbot
• Gozi
• Icedid
• Blackmoon

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/qbot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Replit, StackBlitz, CodeSandbox, and CodePen.