Backdoor.Qbot is Malwarebytes' detection name for a large family of Backdoor Trojans that has been around in one form or another since 2009.
Backdoor.Qbot is mainly a banking Trojan and passwordstealer. It is worth noting that most varianst are VM-aware and some have polymorphic abilities. Backdoor.Qbot main source are exploit kits but they are also spread by infected email attachments.
Malwarebytes can detect and remove Backdoor.Qbot without further user interaction.
Backdoor.Qbot may install different files upon execution. It is usually installed in the folder %ALLUSERSPROFILE%, for example:
%ALLUSERSPROFILE% \Microsoft\oraene2 %ALLUSERSPROFILE% _qbothome_qbot.dll
but also
%APPDATA% \microsoft\jwkljxnw\jwkljx.dll %APPDATA% \roaming\microsoft\jwkljxnw\jwkljxn.exe
Once installed, Backdoor.Qbot replaces existing registry data found in subkey "HKEY_LOCAL_MACHINE\Microsoft\Windows\CurrentVersion\Run" so that the malware runs at each Windows start. The malware prepends itself to a previously existing entry. For example, we have seen it create the following registry entry:
In subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run Sets value: "<random characters>" With data: ""%APPDATA%\microsoft\jwkljxnw\jwkljxn.exe" It usually creates a mutex to ensure that only one instance of itself is running, for example:
enagk
Backdoor.Qbot attempts to connect to a remote server to receive command instructions from a threat actor. Commands may include any of the following actions:
Install additional files Execute processes Download updates Log keystrokes Steal passwords from MSN, Internet Explorer, and Outlook Get system information Monitor several Web sites, some of which are related to banks and other financial institutions Steal cookies and certificates Downloads other malware
Backdoor.Qbot may connect to remote sites to download updates or additional malware, which are then installed in the computer.
Some of the domains it is known to connect to are:
nt11.co.in nt002.cn
Select your language