Loading malware…
CNB Bot is a previously undocumented .NET implant and loader used by the financially motivated REF1695 operation against Windows systems. It is distributed through counterfeit software installers, including ISO-based lures that socially engineer victims into bypassing Microsoft SmartScreen. A preceding loader can weaken Microsoft Defender protections before installing CNB Bot and presenting a decoy application error.
CNB Bot polls command-and-control infrastructure over HTTP POST with encrypted request values and authenticates received operator tasks using RSA-2048 RSA-SHA256 signatures. It supports downloading and executing additional payloads, self-updating, and uninstalling itself with cleanup actions, making it a modular staging component for follow-on malware. It establishes high-privilege scheduled-task persistence and performs virtual-machine and analysis-environment checks based on host, firmware, process, registry, and network-adapter characteristics. REF1695 has used CNB Bot alongside remote-access malware and cryptocurrency-mining payloads as part of campaigns monetized through cryptomining and CPA fraud.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
CNB Bot is a previously undocumented .NET implant with RSA-2048 signed task authentication.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
These attacks leverage an ISO file as the infection vector to deliver a .NET Reactor-protected loader
The best protection against this threat is to avoid unofficial installers and cracked software.
Campaign 2 registers a scheduled task named SVCConfig with an ONLOGON trigger and HIGHEST privilege; CNB Bot creates HostDataProcess to run every 10 minutes.
By decrypting traffic captured in VirusTotal sandboxes, we observed that the C2 server at windirautoupdates[.]top was automatically issuing a download-and-execute task directing the implant to fetch an XMR mining payload from https://github[.]com/.../MnrsInstllr_240126[.]exe.
The loader invokes PowerShell with -WindowStyle Hidden to register Defender exclusions, execute extracted stages, and launch payloads.
...a fake ISO file that distributed a .NET Reactor-protected loader... REF1695 also leveraged ISO lures to spread... a custom .NET-based XMRig loader...
...distributed a .NET Reactor-protected loader...
They talk the user through bypassing SmartScreen by clicking More Info and Run Anyway.
The operation deploys RATs and cryptominers through fake installer packages; Campaign 1 uses an ISO containing a protected loader and a ReadMe.txt lure.
Campaign 2 registers a scheduled task named SVCConfig with an ONLOGON trigger and HIGHEST privilege; CNB Bot creates HostDataProcess to run every 10 minutes.
The watchdog is responsible for monitoring the loader file in its persistence folder: it rewrites the file to disk if it is deleted and reinstalls the persistence mechanism if the scheduled task or registry key is deleted.
Campaign 2 registers a scheduled task named SVCConfig with an ONLOGON trigger and HIGHEST privilege; CNB Bot creates HostDataProcess to run every 10 minutes.
The watchdog is responsible for monitoring the loader file in its persistence folder: it rewrites the file to disk if it is deleted and reinstalls the persistence mechanism if the scheduled task or registry key is deleted.
The scam usually starts with a fake download, often an ISO file. To dodge security checks, the hackers include a ReadMe.txt file that uses social engineering. It claims the software is from a small non-profit team of developers that can’t afford official Windows certificates and is providing the software for free.
Stage 2 writes a temporary .bat file that forcefully deletes the installer binary; CNB Bot self-deletes the original copy via a self-deleting BAT script.
...distributed a .NET Reactor-protected loader...
The encrypted next-stage module is stored as a .NET resource and decrypted via Triple DES (3DES) in CBC mode using an embedded key and IV. The decrypted output is a GZip-compressed PE.
Execute: .exe (hidden), .bat/.cmd (cmd /c), .vbs (wscript.exe), other (ShellExecute).
Writes a VBScript wrapper sysdata.vbs alongside the binary: CreateObject("WScript.Shell").Run """<installed_path>""", 0, False. Creates a scheduled task named HostDataProcess via schtasks.exe, configured to run wscript.exe //nologo sysdata.vbs every 10 minutes at HIGHEST privilege
At startup, CNB Bot uses five different methods to check for VM detection...
CNB Bot checks WMI manufacturer/model and BIOS data, VM-related processes, registry keys, and virtual-machine MAC prefixes.
After a 3-second sleep, the XMRig loader starts its evasion timer; CNB Bot enters Thread.Sleep(int.MaxValue) when its VM-detection threshold is reached.
...the eventual deployment of the CNB Bot implant that permits further payload injections...
The loader invokes hidden PowerShell to register broad Microsoft Defender exclusions via Add-MpPreference -ExclusionPath and Add-MpPreference -ExclusionProcess.
CNB Bot sends local IPv4 information and retrieves the external IP via ipify[.]org, icanhazip[.]com, or ident[.]me.
Fields sent on every request: desktop machine name, username username, os Windows version... privileges user OR admin... client_path full path of running executable... external IP via ipify[.]org / icanhazip[.]com / ident[.]me
On each tick, IsAnalysisToolRunning() compares all running process names against a hardcoded list of 35 security and monitoring tools (Taskmgr, ProcessHacker, Wireshark, Procmon, etc.).
CNB Bot profiles the victim and sends Windows version, privileges, processor name, GPU names, and executable path to its C2.
At startup, CNB Bot uses five different methods to check for VM detection...
CNB Bot checks WMI manufacturer/model and BIOS data, VM-related processes, registry keys, and virtual-machine MAC prefixes.
After a 3-second sleep, the XMRig loader starts its evasion timer; CNB Bot enters Thread.Sleep(int.MaxValue) when its VM-detection threshold is reached.
While most recent campaigns involved a fake ISO file that distributed a .NET Reactor-protected loader and text file facilitating the eventual deployment of the CNB Bot implant... REF1695 also leveraged ISO lures to spread the PureMiner and PureRAT payloads...
It communicates with a command-and-control (C2) server using HTTP POST requests.
CNB Bot communicates with C2 by HTTP POST requests; PureRAT uses configured web C2 servers to receive encrypted Protobuf command messages.
PureRAT received a download-and-execute task directing it to fetch an XMR mining payload from a raw GitHub URL; CNB Bot supports download_execute.
These tools give the hackers full remote access to your files, the ability to update their malicious code
the group hosts malicious files on trusted platforms like GitHub and uses high-level RSA-2048 encryption to control their bots.
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.