![\"Example](\"https:\/\/media.kasperskycontenthub.com\/wp-content\/uploads\/sites\/43\/2023\/04\/14152916\/QBot_new_scheme_01.png\")
<\/a><\/p>\nExample of a forwarded letter containing a malicious attachment<\/em><\/strong><\/p>\n Such simulated business correspondence can obstruct spam tracking while increasing the probability of the victim falling for the trick. For authenticity, the attackers put the sender’s name from the previous letters in the ‘From’ field; however, the sender’s fraudulent e-mail address will be different from that of the real correspondent.<\/p>\n The banking Trojan QBot was detected for the first time in 2007. Since then, it has gone through multiple modifications and improvements to become one of the most actively spread malware in 2020. In 2021, we published a detailed QBot technical analysis<\/a>. Currently the banker keeps getting new functions and module updates for increased effectiveness and profit.<\/p>\n QBot distribution methods have also evolved. Early on it was distributed through infected websites and pirated software. Now the banker is delivered to potential victims through malware already residing on their computers, social engineering, and spam mailings.<\/p>\n New QBot infection chain<\/em><\/strong><\/p>\n The QBot malware delivery scheme begins with an e-mail letter with a PDF file in the attachment being sent. The document’s content imitates a Microsoft Office 365 or Microsoft Azure alert advising the user to click Open to view the attached files. If the user complies, an archive will be downloaded from a remote server (compromised site), protected with a password given in the original PDF file.<\/p>\nA short look at QBot<\/h2>\n
QBot infection chain<\/h2>\n
<\/a><\/p>\n