Loading malware…
PBot, also referred to as PythonBot, is a Python-based Windows adware framework with man-in-the-browser functionality and behavior consistent with a browser-injecting banking trojan. It became known in 2018 and has been observed delivered through the RIG exploit kit as well as through NSIS-based installer chains that bundle a full Python runtime and supporting components, allowing the malware to execute on victim systems without requiring a preinstalled interpreter.
PBot is designed to modify a victim’s web experience by injecting JavaScript into legitimate websites, operating a malicious local proxy, and intercepting browser traffic. Its architecture has included obfuscated Python loaders, configuration files, encrypted or encoded binary blobs, and native components injected into processes associated with the bundled Python environment and targeted browsers. Browser-focused modules hook networking and certificate-related APIs to inspect and alter traffic, and the malware has been observed forging HTTPS certificates to facilitate interception of encrypted sessions. These capabilities enable ad injection, fake-click activity, advertising fraud, and broader web-content manipulation. Reporting has also assessed that the framework could be repurposed for more overtly malicious financial theft scenarios, and some analyses characterize it as likely intended for banking-trojan use.
Persistence mechanisms observed in PBot infections include autorun entries, scheduled tasks, and startup-folder shortcuts. Updated variants have used staged retrieval of configuration and payload data, including DNS TXT record lookups and subsequent download of configuration files that specify additional components to fetch and deploy. Some campaigns also bundled a Chrome extension with broad browser permissions to support further ad-loading and traffic-manipulation activity.
PBot has shown selective targeting logic. Configuration artifacts have included exclusions for Russian banking sites, indicating deliberate geofencing or operator-imposed restrictions. The malware’s operational focus has centered on monetization through ad fraud and browser manipulation, but its man-in-the-browser design gives operators the ability to alter victim-visible content and potentially support phishing or credential interception workflows.
PBot should be distinguished from unrelated botnet malware that has used similar naming in isolated reporting. In the context of PythonBot/PBot, the malware family is best understood as a Windows browser-manipulation and ad-fraud platform built around Python components and bundled execution dependencies.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
19 distinct techniques documented for this family, organized by ATT&CK tactic.
checkers=[chkStartUpLnk, chkRegRun, chkTask] ... deleters=[delStartUpLnk, delRegRun, delTask] healers=[setStartUpLnk, setRegRun, setTask]
checkers=[chkStartUpLnk, chkRegRun, chkTask] ... deleters=[delStartUpLnk, delRegRun, delTask] healers=[setStartUpLnk, setRegRun, setTask]
checkers=[chkStartUpLnk, chkRegRun, chkTask] ... deleters=[delStartUpLnk, delRegRun, delTask] healers=[setStartUpLnk, setRegRun, setTask]
After decoding and deobfuscating the scripts... ‘start.pyc’ is responsible for loading in, XOR decoding and executing ‘start.bin’... Decoding will utilize a list of list that is stored pickled at the base of a base64 blob
Although it arrives under the disguise of a MinerBlocker... The second component is named MinerBlocker... It pretends to be a legitimate application dedicated to blocking malicious miners.
First of all, it injects scripts into each website you visit... once it is injected, the attackers are in control of the contents displayed in our browser. They can inject ads, but also any other much more malicious content.
Decoded: http://efrcqwvv[.]xyz/upd After adding the suffix we would be left with http://efrcqwvv[.]xyz/upd/my
This DLL is responsible for parsing the configuration and setting up the malicious proxy... By this way, all the requests are redirected to the malware. It can work as a proxy, altering data on the way.
93 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A P2P botnet mentioned for comparison because its DDoS module naming conventions resemble those seen in the Korpze campaign.
Python-based adware/botnet framework delivered via NSIS installers. It decodes and executes embedded Python/PE components, installs persistence, retrieves updates/configuration from infrastructure including DNS TXT-record based URLs, and loads JavaScript chains used for ad fraud, fake clicks, invisible iframes, tracking, and browser-extension monetization/abuse.
A Python malware bundle delivered via the RIG exploit kit that packaged a full Python environment and supported injects and man-in-the-browser functionality; the article assesses it as probably a banking trojan.
Python-based adware delivered by the RIG exploit kit. It installs a bundled Python environment, achieves persistence via Run keys, injects JavaScript into visited websites, forges certificates, hooks browser networking and certificate functions, and performs man-in-the-browser traffic interception and content modification.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.