CNB Bot
CNB Bot is a previously undocumented .NET implant/loader associated with the financially motivated threat cluster REF1695, active since at least late 2023. It has been delivered via fake software installers, commonly packaged as ISO files, in campaigns that also deployed PureRAT, PureMiner, SilentCryptoMiner, and a custom .NET-based XMRig loader. The infection chain uses social engineering to convince victims to bypass Microsoft Defender SmartScreen, often via a ReadMe.txt lure, after which a .NET Reactor-protected loader invokes PowerShell to add broad Microsoft Defender Antivirus exclusions, launches CNB Bot in the background, and displays a fake application error.
CNB Bot permits further payload injection and acts as a loader with download-and-execute capability. Reported functionality includes self-update and uninstall with cleanup actions. It communicates with command-and-control infrastructure over HTTP POST and uses AES-256-CBC-encrypted configuration values. Operator tasking is authenticated with RSA-SHA256 using a hardcoded RSA-2048 public key, described as RSA-2048 signed task authentication. Observed C2 servers include tabbysbakescodes[.]ws and tommysbakescodes[.]ws.
For persistence, CNB Bot was reported to create a scheduled task named HostDataProcess that launches a VBScript wrapper every 10 minutes with highest privileges. It also performs anti-analysis and VM-detection checks using WMI, process names, registry keys, and MAC address prefixes before active operation. The malware is part of a broader REF1695 operation targeting Windows systems for long-term monetization through follow-on malware deployment, Monero cryptomining, and CPA fraud. The actor has also abused GitHub as a trusted payload delivery platform to host staged binaries.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
However, instead of the promised software, a series of loaders installs a malicious toolkit including CNB Bot, PureRAT, and SilentCryptoMiner.
Techniques & procedures
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniquesThese attacks leverage an ISO file as the infection vector to deliver a .NET Reactor-protected loader
The best protection against this threat is to avoid unofficial installers and cracked software.
Execution
6 techniquesStage 3 is launched through PowerShell, and a scheduled task named SVCConfig is registered via schtasks.exe with an ONLOGON trigger and HIGHEST privilege.
By decrypting traffic captured in VirusTotal sandboxes, we observed that the C2 server at windirautoupdates[.]top was automatically issuing a download-and-execute task directing the implant to fetch an XMR mining payload from https://github[.]com/.../MnrsInstllr_240126[.]exe.
The loader is designed to invoke PowerShell, which is responsible for configuring broad Microsoft Defender Antivirus exclusions to fly under the radar and launch CNB Bot in the background.
...a fake ISO file that distributed a .NET Reactor-protected loader... REF1695 also leveraged ISO lures to spread... a custom .NET-based XMRig loader...
...distributed a .NET Reactor-protected loader...
They talk the user through bypassing SmartScreen by clicking More Info and Run Anyway.
Persistence
2 techniquesStage 3 is launched through PowerShell, and a scheduled task named SVCConfig is registered via schtasks.exe with an ONLOGON trigger and HIGHEST privilege.
Privilege Escalation
2 techniquesStage 3 is launched through PowerShell, and a scheduled task named SVCConfig is registered via schtasks.exe with an ONLOGON trigger and HIGHEST privilege.
Stealth
9 techniquesThe scam usually starts with a fake download, often an ISO file. To dodge security checks, the hackers include a ReadMe.txt file that uses social engineering. It claims the software is from a small non-profit team of developers that can’t afford official Windows certificates and is providing the software for free.
Following payload launch, Stage 2 writes a temporary .bat file to %TEMP% with a polling loop that forcefully deletes the installer binary until successful, then deletes the batch file itself.
...distributed a .NET Reactor-protected loader...
The encrypted next-stage module is stored as a .NET resource and decrypted via Triple DES (3DES) in CBC mode using an embedded key and IV. The decrypted output is a GZip-compressed PE.
Execute: .exe (hidden), .bat/.cmd (cmd /c), .vbs (wscript.exe), other (ShellExecute).
Writes a VBScript wrapper sysdata.vbs alongside the binary: CreateObject("WScript.Shell").Run """<installed_path>""", 0, False. Creates a scheduled task named HostDataProcess via schtasks.exe, configured to run wscript.exe //nologo sysdata.vbs every 10 minutes at HIGHEST privilege
At startup, CNB Bot uses five different methods to check for VM detection...
At startup, CNB Bot uses five different methods to check for VM detection... WMI ComputerSystem Manufacturer/Model... WMI BIOS Version/Serial... Process list... Registry... MAC Address... When the detection threshold is reached, the first process instance acquires a named mutex and enters an infinite sleep.
...the eventual deployment of the CNB Bot implant that permits further payload injections...
Discovery
5 techniquesFields sent on every request: desktop machine name, username username, os Windows version... privileges user OR admin... client_path full path of running executable... external IP via ipify[.]org / icanhazip[.]com / ident[.]me
On each tick, IsAnalysisToolRunning() compares all running process names against a hardcoded list of 35 security and monitoring tools (Taskmgr, ProcessHacker, Wireshark, Procmon, etc.).
Fields sent on every request: ... cpu processor name from the registry, gpu GPU name(s) from registry, gpu_type yes (discrete) / no (integrated)
At startup, CNB Bot uses five different methods to check for VM detection...
At startup, CNB Bot uses five different methods to check for VM detection... WMI ComputerSystem Manufacturer/Model... WMI BIOS Version/Serial... Process list... Registry... MAC Address... When the detection threshold is reached, the first process instance acquires a named mutex and enters an infinite sleep.
Collection
1 techniqueWhile most recent campaigns involved a fake ISO file that distributed a .NET Reactor-protected loader and text file facilitating the eventual deployment of the CNB Bot implant... REF1695 also leveraged ISO lures to spread the PureMiner and PureRAT payloads...
Command and Control
5 techniquesIt communicates with a command-and-control (C2) server using HTTP POST requests.
The malware communicates with its C2 by issuing HTTP POST requests with the Content-Type set to application/x-www-form-urlencoded.
instead of the promised software, a series of loaders installs a malicious toolkit including CNB Bot, PureRAT, and SilentCryptoMiner.
These tools give the hackers full remote access to your files, the ability to update their malicious code
the group hosts malicious files on trusted platforms like GitHub and uses high-level RSA-2048 encryption to control their bots.
Other
1 techniqueIOCs tracked for this family
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Part of the malicious toolkit delivered through fake software installers; used to give the attackers persistent control and the ability to update malicious code.
An implant used to provide remote access and enable additional payload injection on compromised systems.
A previously undocumented .NET implant that functions as a loader, capable of downloading and executing additional payloads, updating itself, uninstalling itself, performing cleanup actions, and communicating with a C2 server over HTTP POST requests.
A previously undocumented .NET implant with integrated loader capabilities. It establishes persistence via scheduled tasks, performs VM checks, polls C2 servers for commands, and supports download-and-execute, self-update, and uninstall/cleanup. It uses AES-256-CBC for communications and RSA-SHA256 signature verification for task authentication.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.