{
  "family": "neurevt",
  "sample_count": 68,
  "category": "trojan",
  "description": "Neurevt (widely recognized across the cybersecurity intelligence ecosystem under the alias Beta Bot, as well as signatures including Trojan:Win32/Neurevt, Trojan.Win32.Neurevt, and Win32/Neurevt) is an infamous modular banking trojan, botnet, and initial access loader first surfacing in 2013. Renowned for its aggressive defense evasion and anti-antivirus capabilities, Neurevt actively hooks native Windows APIs to block antimalware software processes, disable Windows Defender, and prevent browser access to security websites. The trojan employs RC4-encrypted HTTP communications for C2 check-ins, performs man-in-the-browser form grabbing to steal online banking and payment card credentials, and logs keystrokes. In addition, Neurevt features modular distributed denial-of-service (DDoS) flood attack capabilities, USB drive worm replication, and a versatile secondary payload loader exploited by multiple cybercrime syndicates across North America and Europe.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Neurevt",
    "Beta Bot",
    "Trojan.Win32.Neurevt",
    "Win32/Neurevt",
    "BetaBot"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Neurevt (Beta Bot) malware family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Neurevt (Beta Bot) is an aggressive modular banking trojan, botnet, and credential stealer known for neutralizing antivirus software."
      }
    },
    {
      "@type": "Question",
      "name": "How does Neurevt impair endpoint security defenses?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks Windows APIs to terminate antivirus processes, block security update URLs, and disable Windows Defender."
      }
    },
    {
      "@type": "Question",
      "name": "What information is stolen by Neurevt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It uses web injection and form grabbing to steal banking logins, credit card numbers, and FTP/SSH credentials."
      }
    },
    {
      "@type": "Question",
      "name": "How does Neurevt spread across networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via spearphishing emails, exploit kits, Skype message spam, and removable USB drive worm routines."
      }
    },
    {
      "@type": "Question",
      "name": "How should enterprise security teams disinfect Neurevt?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate the endpoint, run an offline bootable scanner to defeat anti-AV hooks, and reset corporate and financial credentials."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1562.001",
    "T1056.001",
    "T1555.003",
    "T1055",
    "T1547.001",
    "T1498",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1498",
      "name": "Network Denial of Service",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to halt active financial credential theft and sever the botnet C2 connection.",
    "Capture a forensic memory image to extract the active Betabot configuration, which often contains the specific banking URLs being targeted and the C2 infrastructure.",
    "Audit the `HOSTS` file and system DNS settings to reverse any modifications made by the malware to block security updates.",
    "Assume the machine is fully compromised and all credentials entered on it are stolen; perform a clean OS rebuild and enforce global password resets."
  ],
  "what_to_avoid": [
    "Do not trust the endpoint's AV status; Betabot is specifically designed to quietly disable or cripple standard antivirus engines.",
    "Avoid allowing the machine to reboot before capturing memory, as critical configurations and decryption keys reside in RAM."
  ],
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Fraud & Cybercrime Monetization",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2013,
  "threat_actor": "Beta Bot Syndicate / Neurevt Operators",
  "delivery_mechanism": [
    "Spearphishing Email Attachments",
    "Drive-by Exploit Kits",
    "USB Removable Media Worm Replication",
    "Skype Automated Messaging Spam"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP"
  ],
  "capabilities": [
    "Active Antivirus Neutralization",
    "Man-in-the-Browser Form Grabbing",
    "RC4 Encrypted HTTP C2 Protocol",
    "DDoS Flooding Modules (SYN, UDP, HTTP)",
    "USB Worm Auto-Replication"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST requests containing RC4-encrypted binary telemetry",
      "High-volume UDP/TCP flood traffic during DDoS activation"
    ],
    "evasion_techniques": [
      "Hooking CreateProcess and OpenProcess to terminate security tools",
      "Blocking DNS requests to major antivirus vendor update domains"
    ],
    "persistence_mechanisms": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\BetaBot",
      "HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Userinit"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "High",
    "scope": "Direct financial fraud, complete security defense impairment, participation in global DDoS botnets"
  },
  "lineage": {
    "derived_from": [
      "Underground Modular Banking Botnets"
    ],
    "variants": [
      "Beta Bot 1.8",
      "Beta Bot 2.0",
      "Neurevt.Gen"
    ]
  },
  "iocs": {
    "file_hashes": [
      "3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f",
      "4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a"
    ],
    "delivery": [
      "invoice_betabot.exe",
      "usb_autorun.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WindowsSystemHelper",
      "%SystemRoot%\\betabot_daemon.exe"
    ]
  },
  "sources": [
    {
      "name": "Cisco Talos Intelligence - The Evolution of Beta Bot / Neurevt",
      "url": "https://blog.talosintelligence.com"
    },
    {
      "name": "Virus Bulletin - Beta Bot: When Trojans Fight Back",
      "url": "https://www.virusbulletin.com"
    }
  ]
}