(Cybereason) Betabot’s main features include: • Browsers Form Grabber • FTP and mail client stealer • Banker module • Running DDOS attacks • USB infection module • Robust Userland Rootkit (x86/x64) • Arbitrary command execution via shell • The ability to download additional malware • Persistence • Crypto-currency miner module (added 2017)
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|
| Domain | Timestamp |
|---|---|
| russk21.icu | 2023-04-26 |
| rusianlover.icu | 2021-03-10 |
| siidocumentos.icu | 2021-03-10 |
| informaciones.siidocumentos.cu | 2021-03-10 |
| URL | Timestamp |
|---|---|
| http://b.uandmearertyasport1.com/direct/mail9/order.php | 2023-02-23 |
| http://elkip.ru/kernel/includes/robots/order.php | 2023-01-28 |
| http://urbanworld.ml/news/order.php | 2022-12-31 |
| http://api.wifi-update.biz/cdn/img.php | 2022-12-23 |
| http://z0m1.com/king/logout.php | 2022-12-08 |
| http://issasname.ws/xyz/abc/order.php | 2022-12-05 |
| http://sunny-displays.com/nex/bb/logout.php | 2022-10-17 |
| http://b.5dietmydartk5.com/direct/mail/order.php | 2022-10-04 |
| http://www.climetrics.com/wp-includes/js/swf/wp-form.php | 2022-10-01 |
| http://ns1.globsynbschool.com/wp-poster.php | 2022-10-01 |
2022-08-08 by Benoît Ancel from Medium CSIS Techblog
2022-03-28 by Mr. Krabs from KrabsOnSecurity
2021-03-31 by Kaspersky from Kaspersky
2020-07-14 by Markel Picado from SophosLabs Uncut
2020-05-14 by Markel Picado from SophosLabs
2018-11-04 by CCN-CERT from CCN-CERT
2018-10-03 by Assaf Dahan from Cybereason
2018-06-15 by Wojciech from Medium woj_ciech
2017-02-27 by Ted Heppner from Sophos
2015-04-15 by Xylitol from XyliBox
2013-09-24 by Hanan Natan from
Tool: BetaBot
Names: BetaBot, Neurevt
Description: (Cybereason) Betabot’s main features include: • Browsers Form Grabber • FTP and mail client stealer • Banker module • Running DDOS attacks • USB infection module • Robust Userland Rootkit (x86/x64) • Arbitrary command execution via shell • The ability to download additional malware • Persistence • Crypto-currency miner module (added 2017)
Category: Malware
Type: Banking trojan, Backdoor, Info stealer, Credential stealer, DDoS, Downloader
Information: https://www.cybereason.com/blog/betabot-banking-trojan-neurevt
Information: https://medium.com/@woj_ciech/betabot-still-alive-with-multi-stage-packing-fbe8ef211d39
Information: http://www.xylibox.com/2015/04/betabot-retrospective.html
Information: https://asert.arbornetworks.com/beta-bot-a-code-review/
Information: http://resources.infosecinstitute.com/beta-bot-analysis-part-1/
Information: https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/BetaBot.pdf
Information: http://www.malwaredigger.com/2013/09/how-to-extract-betabot-config-info.html
Information: https://blog.talosintelligence.com/2021/08/neurevt-trojan-takes-aim-at-mexican.html
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.betabot
Alienvault-otx: https://otx.alienvault.com/browse/pulses?q=tag:betabot
Last-card-change: 2021-11-01
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |