[R136a1]

Hi folks,

first discovered this bot a few months ago. It seems to be a work in progress, because bot and loader are full of debug strings. Currently, it constantly crashes explorer.exe after injection process on all Windows versions up to Windows 10. Might be anyway interesting for future research, since it looks like a bigger project...

Earlier version only consists of a dropper for the x86 and x86-64 payloads, later versions also come with a loader. At moment, it is not classified by any AV software.

August sample:
Dropper
https://www.virustotal.com/en/file/e207 ... /analysis/

November samples:
Loader
https://www.virustotal.com/en/file/2cbb ... /analysis/
https://www.virustotal.com/en/file/72cd ... /analysis/
https://www.virustotal.com/en/file/599b ... /analysis/
Dropper
https://www.virustotal.com/en/file/e356 ... /analysis/

[p4r4n0id]

Hi,

A short analysis of Ardbot - http://breakingmalware.com/malware/ardb ... struction/

R136a1 - we gave you the credit :)

Cool find!

p4r4n0id