Sdbot

Overview

sdbot is classified as a remote access trojan (RAT), malware that gives an attacker remote control of an infected computer. It has one or more associated MITRE ATT&CK technique references (linked on this page) that document the behaviors observed for it. We have not yet published a hand-verified detailed profile for this family; the MITRE references below are the authoritative source for its documented techniques.

Known aliases

Threat reports may refer to this family under multiple names:

• win32.sdbot
• sdbot.worm
• rbot
• spybot
• sdbot.a

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1059.003 T1071.003 T1547.001 T1105 T1091 T1498

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.003: Restrict execution of Windows Command Shell (cmd.exe) and block unauthorized batch scripts.
• T1071.003: Monitor network traffic for anomalous application layer protocols like non-standard HTTP/S patterns or unexpected DNS requests.
• T1105: Implement network intrusion detection systems (NIDS) and host-based firewalls to block unauthorized inbound or outbound file transfers.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_SDBOT {
    meta:
        description = "Detects Sdbot (rat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "sdbot" ascii wide nocase
        $s2 = "win32.sdbot" ascii wide nocase
        $s3 = "sdbot.worm" ascii wide nocase
        $s4 = "rbot" ascii wide nocase
        $s5 = "spybot" ascii wide nocase
        $s6 = "sdbot.a" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Sdbot Activity
id: dc1efed9e974e10bbb00bc22910b8ad6
status: experimental
description: Detects generic indicators of the sdbot malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*sdbot*"
            - "*win32.sdbot*"
            - "*sdbot.worm*"
            - "*rbot*"
            - "*spybot*"
            - "*sdbot.a*"
    condition: selection
level: medium

References & External Analysis

• Search "sdbot" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: rat)

Explore other malware families in the same category:

• Njrat
• Spygate
• Betabot
• Nanobot
• Wabot

Machine-readable

Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/sdbot.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.