Qbot / Qakbot Info-Stealer & Backdoor

What is QAKBOT_STEALER_BACKDOOR?

Qakbot (or Qbot) is a long-standing information-stealing Trojan and backdoor. It captures banking credentials, keystrokes, and emails, and acts as an entry point for ransomware gangs to deploy larger payloads like Black Basta.

Common Causes

• Phishing emails with malicious OneNote files, PDFs, or ZIP archives
• Drive-by downloads on compromised web pages
• Lateral movement via SMB share exploits

Step-by-Step Fix Guide

• 1
  Perform a full offline malware scan and clean the registry startup paths
• 2
  Block outbound connections to known C2 server IP addresses
• 3
  Enforce strict email gateway attachments filters
• 4
  Reset all compromised account credentials

Commands & Diagnostics