Win32/Qbot [Threat Name] go to Threat

Win32/Qbot.AY [Threat Variant Name]

Category	trojan
Size	410256 B
Aliases	Backdoor:Win32/Qakbot.gen!C (Microsoft)
	W32.Qakbot (Symantec)

Win32/Qbot.AY installs a backdoor that can be controlled remotely.

When executed, the trojan creates the following folders:

The following files are dropped in the same folder:

In order to be executed on every system start, the trojan sets the following Registry entry:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
- "%variable4%" = "%commonappdata%\microsoft\%variable1%\%variable1%.exe"

A string with variable content is used instead of %variable1-4% .

The trojan may replace existing Registry records referenced by the following Registry entries with the link to malware file:

The trojan creates and runs a new thread with its own program code within the following processes:

The trojan may create copies of itself using the following filenames:

A string with variable content is used instead of %variable% .

The trojan contains a backdoor. It can be controlled remotely.

The trojan acquires data and commands from a remote computer or the Internet.

The trojan contains a list of URLs. The HTTP, FTP, IRC protocol is used.

It can execute the following operations:

log keystrokes
run executable files
terminate running processes
download files from a remote computer and/or the Internet
send files to a remote computer
update itself to a newer version
send gathered information
block access to specific websites
steal information from the Windows clipboard
insert IFRAME tag(s) into HTML pages with a specific URL pointing to malicious software
create a scheduled task that repeatedly executes the malicious file

The trojan collects the following information:

The trojan blocks access to any domains that contain any of the following strings in their name:

The trojan collects sensitive information when the user browses certain web sites.

The following keywords are monitored:

The trojan hooks the following Windows APIs:

The trojan may replace existing Registry records referenced by the following Registry entries with the link to malware file:

The trojan may set the following Registry entries:

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
- "%variable4%" = "%commonappdata%\microsoft\%variable1%\%variable1%.exe"

The trojan may create the following files:

A string with variable content is used instead of %variable% .