A forum for reverse engineering, OS internals and malware analysis 

PbBot malware family (Non-bootkit)

Forum for analysis and discussion about malware.

PbBot malware family (Non-bootkit)

 #16723  by cjbi
 Tue Nov 20, 2012 11:06 am
General description of PbBot malware family (incl. bootkit):
Korean online card gamer targeted malware (for spying)

Old and recent samples attached.

P.S Some payload is interesting. :) (e.g., DFMgr.dll)
Attachments
pass: infected
(4.47 MiB) Downloaded 72 times

Re: PbBot malware family (Non-bootkit)

 #19136  by cjbi
 Wed May 01, 2013 11:52 am
Windows 7 x64 targeted "PbBot downloader" detected.
Win7Elevate and signed driver inside.
Droppers and payloads attached.

VirusTotal result(s):
Legit installer + Dropper
wLauncherS2.exe.vir 15/45 https://www.virustotal.com/ru/file/6804 ... 367408510/

Dropper
special.exe.vir 17/46 https://www.virustotal.com/ru/file/a262 ... 367407611/

Payloads
InstDrv.exe.vir 2/46 https://www.virustotal.com/ru/file/c77b ... 367408868/
Rdrv64.sys.vir 0/46 https://www.virustotal.com/ru/file/f66b ... 367408982/
Win7Elevate.exe.vir 9/46 https://www.virustotal.com/ru/file/8855 ... 367408987/

Final payload: Delphi coded PbBot
demo.EXE.vir 8/46 https://www.virustotal.com/ru/file/1f3b ... 367408790/
Attachments
pass: infected
(955 KiB) Downloaded 44 times
 Return to “Malware”