The initial infection appeared to occur from downloading a malicious PDF file and exploiting a. vulnerability in Adobe Acrobat Reader on one users computer. It dropped an EXE file in the C:Windows folder that was named. _qbotxxxxxxx.exe. The threat was discovered during their evaluation of Sophos Anti-Virus as Troj/Qbot-B. The customer had a serious concern about data having been stolen by this bot once SophosLabs provided us with an analysis of the threat.”]
Source: https://nakedsecurity.sophos.com/2009/05/29/datastealing-trojan-microscope/