QBOT Malware Analysis
released on 2022-08-25 @ 12:54:14 PM
QBOT, also known as QAKBOT, is a modular Trojan active since 2007 used to download and run binaries on a target machine. QBOT is a multistage, multiprocess binary that has capabilities for evading detection, escalating privileges, configuring persistence, and communicating with C2 through a set of IP addresses. The C2 can update QBOT, upload new IP addresses, upload and run fileless binaries, and execute shell commands.