{
  "family": "betabot",
  "sample_count": 3,
  "category": "rat",
  "description": "Trojan:Win32/Betabot (also known as Neurevt) is a sophisticated password stealer, botnet agent, and banking trojan that gained infamy for its aggressive defense evasion and ability to disable antivirus software.<br><br><b>What is Betabot?</b><br>For users, Betabot operates stealthily, stripping their system of defenses while quietly harvesting credentials. For security analysts, Betabot is recognized as a modular threat that evolved from a simple password stealer into a robust botnet capable of DDoS attacks, USB propagation, and web injects. Its most defining characteristic is its aggressive User Account Control (UAC) bypass and systematic disabling of over 30 different security products.<br><br><b>Infection Vectors & Threat Hunting</b><br>Betabot is distributed via exploit kits, malicious spam (often disguised as Skype voice messages or invoices), and drive-by downloads. Upon execution, it presents the user with a fake Windows UAC prompt to elevate its privileges. Once elevated, it actively terminates processes related to Windows Defender, Malwarebytes, and other AV solutions. Threat hunters should look for sudden gaps in EDR telemetry or unexpected termination of security services. Betabot establishes persistence by injecting into <code>explorer.exe</code> and modifying the registry. <br><br><b>Forensic Analysis & Impact</b><br>The impact is comprehensive data theft, including FTP credentials, browser passwords, and banking sessions. Betabot also intercepts form data before it is encrypted via HTTPS. Incident responders should analyze network traffic for its HTTP-based C2 communications, which are often encrypted with RC4. Memory forensics is crucial to extract the injected core module and identify the C2 domains.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1111",
    "T1548.002",
    "T1055",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1548.002",
      "name": "Abuse Elevation Control Mechanism: Bypass User Account Control",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1111",
      "name": "Two-Factor Authentication Interception",
      "tactic": "Credential Access"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network to halt the exfiltration of passwords and banking credentials.",
    "Do not trust the local AV on the infected machine, as Betabot's primary function is to blind or permanently corrupt security software.",
    "Utilize an offline bootable AV scanner or EDR memory analysis to locate and eradicate the Betabot payload from <code>explorer.exe</code>.",
    "Force a global password reset for the user, paying special attention to FTP and VPN credentials often targeted by Betabot."
  ],
  "what_to_avoid": [
    "Avoid attempting to manually restart stopped AV services; Betabot uses a watchdog process to immediately terminate them again.",
    "Do not rely on standard user-level permissions to protect the system; Betabot's social engineering UAC bypass is highly effective at gaining SYSTEM privileges."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}