Qbot

Overview

QakBot (widely referenced as Qbot or Pinkslipbot) is an aggressive, modular banking trojan and malware loader that operated for over 16 years, emerging around 2007 and evolving into one of the most prolific initial access vectors for enterprise ransomware operators. QakBot spreads primarily via weaponized email phishing campaigns featuring malicious OneNote documents, hijacked email thread replies, and weaponized archives (ZIP, ISO, VHD). Once running on an endpoint, QakBot injects into legitimate processes (such as wermgr.exe or mobsync.exe), steals stored web browser credentials, harvests emails to conduct thread-hijacking for secondary spreading, and performs automated Active Directory and network reconnaissance. In high-value corporate intrusions, QakBot operators historically brokered access to major ransomware syndicates, including Black Basta, Conti, REvil, and MegaCortex. In August 2023, the U.S. Department of Justice, FBI, and Europol executed 'Operation Duck Hunt', seizing 52 C2 servers, recovering $8.6 million in illicit cryptocurrency, and sending uninstallation instructions to over 700,000 compromised host computers worldwide.

Known aliases

Threat reports may refer to this family under multiple names:

• Qakbot
• Pinkslipbot
• Trojan.Qbot
• Banking.Qakbot
• Win32/Qakbot
• qbot

Threat Actor Attribution

Attribution is probabilistic, not a science. Each link below states its confidence level and the evidence behind it.

• TA570 / TA577 (QakBot Syndicate) High confidence
  Basis: Tracked by Proofpoint, Mandiant, and Microsoft (Storm-0216). In August 2023, the FBI, US Department of Justice, Europol, and the French/German/Dutch national police executed 'Operation Duck Hunt', seizing 52 servers, confiscating $8.6M in cryptocurrency, and disinfecting over 700,000 victim endpoints across the globe. [source]

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Known Derivatives & Downstream Variants: Pinkslipbot

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1566.001: Scan email attachments for malicious macros, scripts, or suspicious archive files.

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

• CVE-2023-38831 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2022-30190 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).
• CVE-2020-1472 — In-depth exploitation analysis and catalog intelligence (NIST NVD ↗).

Command & Control (C2) and Network Profile

How this family talks to its operators. C2 traffic can often identify a family even when its code and configuration are hard to analyse. Ports and patterns are historical and change between campaigns, so use them as hunting leads rather than block-only rules.

Network detection ideas

• Block network connections to residential/SMB IP addresses listening on ports 995, 2222, 443 matching abuse.ch Feodo Tracker QakBot feeds
• Alert on anomalous outbound TLS handshakes using non-standard TLS ports or untrusted self-signed certificates from standard user workstations
• Detect email thread-hijacking patterns where inbound external emails reply to existing internal thread subjects with attached ZIP/ISO files

Sources: US DOJ Operation Duck Hunt Announcement, abuse.ch Feodo Tracker

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

• a9e53be16a6bf9999056608ae3a429bca63a5666ee3b652df2beab7e600ef7e8
• 1bc7ee24bf3692e8fa4c3f56ebc5970c40cebf656a1bce47b74f391152a4e98f
• 4ffc186835a74659f170423c91465d3ec62b1e7c53d51786ce45464fb5f4581d

Delivery vectors

• Hijacked reply-chain email threads with password-protected ZIP
• OneNote (.one) attachments executing PowerShell or MSHTA
• Weaponized ISO and VHD disk image container files

Persistence mechanisms

• Scheduled tasks executing injected DLLs via regsvr32.exe
• Process injection into wermgr.exe and mobsync.exe

Detection Guidance

Detection ideas drawn from public reporting. Tune to your environment before deploying.

• YARA rules from CISA Qakbot advisory
• Sysmon detections for regsvr32.exe loading DLL from %APPDATA%
• EDR rule for explorer.exe injecting into msra.exe or mobsync.exe

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

rule MALWARE_WIN_QBOT_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Qbot"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "qbot" ascii wide nocase
        $s2 = "qakbot" ascii wide nocase
        $s3 = "pinkslipbot" ascii wide nocase
        $s4 = "trojan.qbot" ascii wide nocase
        $s5 = "banking.qakbot" ascii wide nocase
        $s6 = "win32/qakbot" ascii wide nocase
        $s7 = "qbot" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

title: SystemHelpDesk Detection - Qbot (Banking Trojan) Execution & Triage
id: a9930fcf-bcad-5f93-8bfa-237b0ffc9f9e
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Qbot malware family. Detects recon staging, certutil file payload staging,
  and web-inject process proxying characteristic of banking trojan initial loaders.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/qbot
- https://malware-families-catalog.systemhelpdesk.com/defensive/banking-trojan-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.banking-trojan
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1566_001
- attack.t1055
- attack.t1078
- attack.t1185
- attack.t1003_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \svchost.exe
    - \explorer.exe
    - \msiexec.exe
    - \certutil.exe
    CommandLine|contains:
    - -urlcache
    - -split -f
    - ipconfig /all
    - route print
    - netstat -ano
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: high

rule MALWARE_WIN_QBOT_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Qbot tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "qbot" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Run FBI-distributed Qakbot uninstaller (where applicable per the 2023 takedown)
2. Isolate the host and block C2 IP ranges
3. Rotate credentials in browser stores and email clients on host
4. Hunt for Cobalt Strike beacons and follow-on ransomware staging

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not rely solely on AV signatures; Qbot updates frequently
2. Do not restore from backups without verifying the backup pre-dates infection
3. Do not ignore email reply-chain hijacking — notify recipients

References & External Analysis

• MITRE ATT&CK: QakBot (S0650)
• CISA Advisory: AA23-242A: QakBot Malware Disrupted in International Cyber Takedown
• Search "qbot" on VirusTotal (External Analysis)
• Search "qbot" on Any.Run (Sandbox Sandbox)
• Search "qbot" on MalwareBazaar (Malware Samples)

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: AA23-242A: QakBot Malware Disrupted in International Cyber Takedown ↗

Frequently Asked Questions

Related Threats (Category: Banking Trojan)

Explore other documented threats in the same operational category:

• Bancos
• A_311_Death
• Shiz
• Icedid
• Danabot
• Tinba
• Clipbanker
• Banbra

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/qbot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.