[Darksin]

Betabot 1.6
https://www.virustotal.com/en/file/56ce ... 385054934/

[Userbased]

The coder copied solarbot.net and is now advertising the bot directly from a website.

Code: Select all

betabot.ru

[Xylitol]

https://www.virustotal.com/en/file/39c2 ... 390228650/ > 0/49

Code: Select all

http://fbcentral.net/software/HPmanager.exe
• dns: 1 ›› ip: 109.163.228.196 - adress: FBCENTRAL.NET

C&C login interface changed a bit since the 1.7 announcement.

[Userbased]

I had a look at one of the C&C's Xylitol posted on cybercrime tracker.

Betabot 1.7 Panel and uncrypted binary

Code: Select all

hxxp://world-star-madness.com/pan.rar

[tx707]

I had a look at one of the C&C's Xylitol posted on cybercrime tracker.

Betabot 1.7 Panel and uncrypted binary

Code: Select all

hxxp://world-star-madness.com/pan.rar

Actually I'm interested on how Xylitol got the panel url anyways.
Damn.. forgot to remove the panel after I've downloaded it. Thanks xylitol...

[Userbased]

The virus bulletin article is out from behind the paywall.

http://blog.fortinet.com/NEUREVT-BOT-ANALYSIS/

The samples in the article are the from versions 1.0 and 1.0.2.5, so some things have changed in the more recent versions.

Interestingly, the article shows that a Skype spreading function was complete and available in the binary, despite the fact that this was (as far as I know) never given as an option in the panel (The author had it listed as an initial feature but was then terrified by the attention it could draw to the bot).

[Xylitol]

https://www.virustotal.com/en/file/62dd ... 398065285/
> http://vxvault.siri-urz.net/ViriList.ph ... 6BC7D3963A

Code: Select all

Key1=CF056C78778C0811
Key2=6E0F2D841777EF11

"-DO NOT SHARE YOUR UNCRYPTED BINARY OR EXECUTABLE. ALWAYS SHARE OR SPREAD YOUR CRYPTED FILE.
-USERS CAUGHT DISTRIBUTING UNCRYPTED BINARIES WILL NO LONGER RECEIVE UPDATES."
Fail.

[Xylitol]

https://www.virustotal.com/en/file/8ce7 ... 399414881/ > 2/51

[Cody Johnston]

Nice post about Betabot Process Injection:

http://vrt-blog.snort.org/2014/05/betab ... ction.html

[Noteworthy]

http://blog.logrhythm.com/security/malw ... t-variant/