Decoding QBit Stealer: Source Release & Data Theft

This report examines the public release of the qBit Stealer source code — a Go-based infostealer associated with the qBit RaaS — and details its operational features (anti-debug/Anti-VM checks, process discovery, configurable targeted file extensions, tar.gz archiving, chunked concurrent uploads to Mega.nz). The analysis highlights that the leak and the stealer's selective targeting make it attractive for use in ransomware double-extortion scenarios and increase the risk of wider adoption by lower-skilled threat actors.