Neurevt

Overview

Trojan:Win32/Neurevt (widely known in the cybersecurity community as Betabot) is a highly versatile, resilient banking trojan and botnet agent known for its aggressive self-defense mechanisms, capability to intercept financial data, and its use in launching Distributed Denial of Service (DDoS) attacks.

Understanding Neurevt (Betabot)
To the victim, Neurevt often operates silently, though system performance may degrade during a DDoS attack. For incident responders, Betabot is a top-tier threat. Discovered around 2012, it is sold on underground forums. It is a multi-purpose tool: it functions as a password stealer, a Man-in-the-Browser (MitB) proxy to manipulate online banking sessions, a ransomware dropper, and a node in a powerful DDoS botnet. It is particularly notorious for attempting to disable antivirus software and blocking access to security websites.

Execution and Evasion Strategies
Neurevt is distributed via exploit kits, spearphishing (malicious macros), and USB drives (using `autorun.inf`). Upon execution, it aggressively seeks to gain administrative privileges (UAC bypass). It establishes persistence by modifying the Registry (`HKCU\Software\Microsoft\Windows\CurrentVersion\Run`) and dropping its executable into the `%AppData%` folder. Betabot utilizes extensive API hooking (Process Injection) to intercept web traffic directly from browsers (`chrome.exe`, `firefox.exe`, `iexplore.exe`), allowing it to steal credentials and inject fraudulent HTML forms. It communicates with its C2 server via encrypted HTTP POST requests to receive new banking web injects or DDoS commands.

Indicators of Compromise & Impact
The impact is severe financial fraud and potential organizational participation in DDoS attacks. EDR platforms will trigger on Betabot's aggressive attempts to disable security services (`T1562.001`) and its extensive API hooking/injection (`T1055`). Network logs may show anomalous, high-volume outbound traffic (during DDoS) or encrypted POST requests to known Betabot C2 domains. Threat hunters should check the Windows `HOSTS` file, as Betabot frequently modifies it to sinkhole traffic to AV update servers.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1185: Enforce strong MFA and use browser isolation or hardened browsers for sensitive financial or administrative portals to defeat session hijacking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_NEUREVT {
    meta:
        description = "Detects Neurevt (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "neurevt" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Neurevt Activity
id: 6ece2dd05f121191481d7919c15b171f
status: experimental
description: Detects generic indicators of the neurevt malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*neurevt*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Instantly isolate the endpoint from the network to halt active financial credential theft and sever the botnet C2 connection.
2. Capture a forensic memory image to extract the active Betabot configuration, which often contains the specific banking URLs being targeted and the C2 infrastructure.
3. Audit the `HOSTS` file and system DNS settings to reverse any modifications made by the malware to block security updates.
4. Assume the machine is fully compromised and all credentials entered on it are stolen; perform a clean OS rebuild and enforce global password resets.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not trust the endpoint's AV status; Betabot is specifically designed to quietly disable or cripple standard antivirus engines.
2. Avoid allowing the machine to reboot before capturing memory, as critical configurations and decryption keys reside in RAM.

References & External Analysis

• Search "neurevt" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: ransomware)

Explore other malware families in the same category:

• Hiru
• Suite
• Genmaldow
• Temcac
• Capredeam

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/neurevt.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.