Excerpt
Check Point Research (CPR) provides an in-depth analysis of the new malware strain dubbed BundleBot spreading under the radar.
BundleBot is abusing the dotnet bundle (single-file), self-contained format that results in very low or no static detection at all.
Commonly distributed via Facebook Ads and compromised accounts leading to websites masquerading as regular program utilities, AI tools, and games.
CPR introduces several techniques that were approved to be effective for reverse engineering the dotnet bundle (single-file), self-contained format.
Introduction
During the past few months, we have been monitoring a new unknown stealer/bot, we dubbed BundleBot, spreading…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on research.checkpoint.com.
Mentioned in the excerpt
More from Check Point88
- Gozi: The Malware with a Thousand FacesCheck Point · Published 28 Aug 2020
- Shattering the Dream - When a Job Offer Becomes a Zero-Day AttackCheck Point · Published 11 Aug
- Impersonation, Click Hijacking, and TDS: Inside a Malware Distribution EcosystemCheck Point · Published 3 Jun
- Cavern Manticore: Exposing Iran-Linked Modular C2 FrameworkCheck Point · Published 6 Jul
On the same topics
- Vidar v1.5 in Go: same family, new language, heavy sandbox checksderp.ca · Published 16 May
- StealC Is Back, and This Time It's a RATVaronis · Published 22 Oct
- Threat Group Cards: A Threat Actor EncyclopediaETDA Threat Group Cards · Added 25 Oct
- GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub RepositoriesThe Hacker News · Published 19 Oct
