Ardbot [x86/x64]

Forum for analysis and discussion about malware.
Post Reply
User avatar
Forum Admin
Posts: 218
Joined: Wed Jul 13, 2011 4:30 pm
Location: Netherlands

Ardbot [x86/x64]

Post by R136a1 » Tue Dec 15, 2015 12:36 pm

Hi folks,

first discovered this bot a few months ago. It seems to be a work in progress, because bot and loader are full of debug strings. Currently, it constantly crashes explorer.exe after injection process on all Windows versions up to Windows 10. Might be anyway interesting for future research, since it looks like a bigger project...

Earlier version only consists of a dropper for the x86 and x86-64 payloads, later versions also come with a loader. At moment, it is not classified by any AV software.

August sample:
Dropper ... /analysis/

November samples:
Loader ... /analysis/ ... /analysis/ ... /analysis/
Dropper ... /analysis/
You do not have the required permissions to view the files attached to this post.

Posts: 126
Joined: Thu Sep 22, 2011 11:36 am
Location: Israel

Re: Ardbot [x86/x64]

Post by p4r4n0id » Mon Dec 21, 2015 2:48 pm


A short analysis of Ardbot - ... struction/

R136a1 - we gave you the credit :)

Cool find!

Keep Low. Move Fast. Kill First. Die Last. One Shot. One Kill. No Luck. Pure Skill.

Post Reply