{
  "family": "neurevt",
  "sample_count": 68,
  "category": "ransomware",
  "description": "Trojan:Win32/Neurevt (widely known in the cybersecurity community as Betabot) is a highly versatile, resilient banking trojan and botnet agent known for its aggressive self-defense mechanisms, capability to intercept financial data, and its use in launching Distributed Denial of Service (DDoS) attacks.<br><br><b>Understanding Neurevt (Betabot)</b><br>To the victim, Neurevt often operates silently, though system performance may degrade during a DDoS attack. For incident responders, Betabot is a top-tier threat. Discovered around 2012, it is sold on underground forums. It is a multi-purpose tool: it functions as a password stealer, a Man-in-the-Browser (MitB) proxy to manipulate online banking sessions, a ransomware dropper, and a node in a powerful DDoS botnet. It is particularly notorious for attempting to disable antivirus software and blocking access to security websites.<br><br><b>Execution and Evasion Strategies</b><br>Neurevt is distributed via exploit kits, spearphishing (malicious macros), and USB drives (using `autorun.inf`). Upon execution, it aggressively seeks to gain administrative privileges (UAC bypass). It establishes persistence by modifying the Registry (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run`) and dropping its executable into the `%AppData%` folder. Betabot utilizes extensive API hooking (Process Injection) to intercept web traffic directly from browsers (`chrome.exe`, `firefox.exe`, `iexplore.exe`), allowing it to steal credentials and inject fraudulent HTML forms. It communicates with its C2 server via encrypted HTTP POST requests to receive new banking web injects or DDoS commands.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe financial fraud and potential organizational participation in DDoS attacks. EDR platforms will trigger on Betabot's aggressive attempts to disable security services (`T1562.001`) and its extensive API hooking/injection (`T1055`). Network logs may show anomalous, high-volume outbound traffic (during DDoS) or encrypted POST requests to known Betabot C2 domains. Threat hunters should check the Windows `HOSTS` file, as Betabot frequently modifies it to sinkhole traffic to AV update servers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1547.001",
    "T1498",
    "T1055",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt active financial credential theft and sever the botnet C2 connection.",
    "Capture a forensic memory image to extract the active Betabot configuration, which often contains the specific banking URLs being targeted and the C2 infrastructure.",
    "Audit the `HOSTS` file and system DNS settings to reverse any modifications made by the malware to block security updates.",
    "Assume the machine is fully compromised and all credentials entered on it are stolen; perform a clean OS rebuild and enforce global password resets."
  ],
  "what_to_avoid": [
    "Do not trust the endpoint's AV status; Betabot is specifically designed to quietly disable or cripple standard antivirus engines.",
    "Avoid allowing the machine to reboot before capturing memory, as critical configurations and decryption keys reside in RAM."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}