Qbot / Qakbot Info-Stealer & Backdoor

What is QAKBOT-STEALER-BACKDOOR?

Qbot / Qakbot Info-Stealer & Backdoor (QAKBOT_STEALER_BACKDOOR) is a high-severity fault affecting the malware/security. Qakbot (or Qbot) is a long-standing information-stealing Trojan and backdoor. It captures banking credentials, keystrokes, and emails, and acts as an entry point for ransomware gangs to deploy larger payloads like Black Basta. Common triggers are drive-by downloads on compromised web pages and lateral movement via SMB share exploits. Follow the steps below to fix it.

Common Causes

• Phishing emails with malicious OneNote files, PDFs, or ZIP archives
• Drive-by downloads on compromised web pages
• Lateral movement via SMB share exploits

Step-by-Step Fix Guide

• 1
  Perform a full offline malware scan and clean the registry startup paths

  Still seeing QAKBOT-STEALER-BACKDOOR after that? "Perform a full offline malware scan and clean the registry startup paths" is the next thing to check.

• 2
  Block outbound connections to known C2 server IP addresses

  Try "Block outbound connections to known C2 server IP addresses" next if the issue persists — it addresses a secondary cause.

• 3
  Enforce strict email gateway attachments filters

  "Enforce strict email gateway attachments filters" covers a less common but documented cause of QAKBOT-STEALER-BACKDOOR.

• 4
  Reset all compromised account credentials

  "Reset all compromised account credentials" targets drive-by downloads on compromised web pages, one of the documented causes of QAKBOT-STEALER-BACKDOOR.

Commands & Diagnostics

Frequently Asked Questions