Palevo

Overview

Worm:Win32/Palevo (widely known as the Butterfly Bot or Mariposa botnet) is a highly prolific, modular botnet agent and worm historically responsible for massive DDoS attacks, widespread credential theft, and the aggressive distribution of secondary malware payloads.

Understanding Palevo (Butterfly Bot)
To the end-user, a Palevo infection might result in a slightly sluggish PC or the sudden hijacking of their social media accounts. For incident responders, it is a severe, multi-faceted threat. Operating at its peak in the late 2000s and early 2010s, the Mariposa botnet (built on the Palevo malware) infected millions of machines globally. It is designed to be highly modular, allowing its operators to dynamically update its capabilities, launch massive UDP/TCP floods, or harvest credentials on an industrial scale.

Execution and Evasion Strategies
Palevo primarily propagates via social engineering on messaging platforms (MSN Messenger, Skype) by sending malicious links to the victim's contacts, via infected USB drives (exploiting the Windows AutoRun feature), or through P2P file-sharing networks. Upon execution, it injects its core payload into legitimate processes (like <code>explorer.exe or svchost.exe) to evade detection. It establishes a covert connection to a C2 server (often using UDP for resilience) to receive commands. Crucially, Palevo employs API hooking to steal passwords from a massive list of applications (browsers, FTP clients, gaming platforms) and intercepts DNS requests.

Indicators of Compromise & Impact
The impact is total endpoint compromise and participation in global cybercrime. Threat hunters should look for anomalous outbound UDP traffic originating from injected system processes. The presence of hidden files on USB drives and unexpected modifications to the Windows HOSTS file are classic Palevo IoCs. EDR platforms frequently flag Palevo for its aggressive API hooking and process injection.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1056.004: Monitor for unauthorized keylogging, screen capturing, or web browser API hooking. Deploy EDR to detect API hooking.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_PALEVO {
    meta:
        description = "Detects Palevo (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "palevo" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Palevo Activity
id: aaff5d9f570ef00a80a262330f3a16b9
status: experimental
description: Detects generic indicators of the palevo malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*palevo*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint to sever the connection to the C2 server, halting DDoS participation and data exfiltration.
2. Force a global password reset for all user accounts, as Palevo systematically harvests credentials from all installed applications.
3. Capture a full memory image to extract the injected Palevo payload and identify the specific C2 infrastructure it was communicating with.
4. Assume total endpoint compromise; perform a clean OS rebuild, as Palevo frequently downloads other severe malware families.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not insert any USB drives into the infected machine during triage; Palevo will immediately infect the drive to spread laterally.
2. Avoid relying solely on manual file deletion; the injected processes will instantly recreate the persistence mechanisms.

References & External Analysis

• Search "palevo" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Komodia
• Mediamagnet
• Globalacces
• Stormattack
• Proinstall

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/palevo.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.