Qbot needs only 30 minutes to steal your credentials, emails


Level 63
Thread author
Honorary Member
Top poster
Content Creator
Apr 24, 2016
The widespread malware known as Qbot (aka Qakbot or QuakBot) has recently returned to light-speed attacks, and according to analysts, it only takes around 30 minutes to steal sensitive data after the initial infection.

According to a new report by DFIR, Qbot was performing these quick data-snatching strikes back in October 2021, and it now appears that the threat actors behind it have returned to similar tactics.

More specifically, the analysts report that it takes half an hour for the adversaries to steal browser data and emails from Outlook and 50 minutes before they jump to an adjacent workstation.
The initial access is typically achieved via an Excel (XLS) document that uses a macro to drop the DLL loader on the target machine.

This payload then executes to create a scheduled task via the msra.exe process and elevates itself to system privileges.

Additionally, the malware adds the Qbot DLL to Microsoft Defender's exclusion list, so it won't be detected when injection into msra.exe happens.
However, no matter how a Qbot infection unfolds precisely, it is essential to keep in mind that almost all begin with an email, so this is the main access point that organizations need to strengthen.

Today's announcement by Microsoft that they will be blocking macros in downloaded documents by default by removing the 'Enable Content' and 'Enable Editing' buttons will go a long way to protecting users from Qbot phishing attacks.

Andy Ful

From Hard_Configurator Tools
Honorary Member
Top poster
Dec 23, 2014
Qbot mostly used one of three email methods: malicious links, malicious attachments, or more recently, embedded images.

In the recent attacks via weaponized Excel documents, the attack used a VBA macro to create a new macrosheet and write Excel 4.0 formulas into its cells. So, blocking the VBA support in MS Office could prevent this attack even if the Excel 4.0 macros were enabled.

In the year 2021, the attackers started using non-active URLs to avoid detecting malware via detonating URLs in the sandbox. So, the user had to write the URL manually in the web browser to continue the infection. In the recent attacks, the malicious URL was displayed as an image embedded in the document.

See also:
Last edited: