Threat Research

PYbot DDoS Malware Being Distributed Disguised as a Discord Nitro Code Generator – ASEC BLOG

Securonix

Threat actors distribute Pybot DDoS disguised as a Discord Nitro generator bundled with illegal cracks and keygens. The campaign uses a DRPU Setup Creator installer to drop a downloader that persists at startup, fetches the Pybot payload, and launches a Python-based DDoS bot with multiple flood capabilities.

Keypoints

  • Pybot DDoS is distributed alongside illegal software like cracks and keygens as a lure.
  • The malware is distributed via an installer using Nitro Generator names such as “nitrogen.exe” or “ntrg.exe”.
  • The downloader creates startup persistence by placing a shortcut in the startup folder to run after reboot.
  • Pybot is packaged with PyInstaller, turning Python code into a Windows executable and including a downloader for an external payload.
  • Pybot supports multiple DDoS attack types (TCP/UDP/SYN floods, VSE floods, HTTP GET floods) to target victims.
  • Indicators of compromise include specific MD5s, a Nitro-related DLL/EXE chain, and C2 URLs used for instruction and payload retrieval.

MITRE Techniques

  • [T1036] Masquerading – The installer and filenames are designed to look legitimate (Nitro Generator-related names) to disguise malicious activity. “The first distributed malware is an installer type malware created using DRPU Setup Creator … distributing the installer using filenames such as “nitrogen.exe” or “ntrg.exe.””
  • [T1547.001] Boot or Logon Autostart Execution: Startup Folder – The downloader creates a startup shortcut so that p.exe (the PYbot) runs after reboot. “and creates a shortcut in the startup folder so that ‘p.exe,’ which is the PYbot, can run even after rebooting.”
  • [T1105] Ingress Tool Transfer – Downloader retrieves and executes additional payload from an external source. “It downloads and executes ‘p.exe’ and ‘n.exe’ in the %TEMP% path and creates a shortcut in the startup folder…”
  • [T1071.001] Web Protocols – C2 communications and download/payload retrieval occur over web-based channels, including a C2 URL. “C&C URL – cnc.dotxyz[.]cf:666 : PYbot”
  • [T1588.002] Acquire Infrastructure – Use of illegal/disguised tooling and distribution infrastructure (Nitro Generator/Discord Nitro theme) to deliver malware. “Nitro Generator is a tool that generates codes that can be used for free access to Nitro.”
  • [T1499] Endpoint Denial of Service – The Pybot DDoS bot implements multiple flood types to perform DDoS attacks. “”The DDoS Bot malware PYbot supports various DDoS attack features, allowing it to not only handle basic layer 4 attacks like TCP Flood, TCP SYN Flood, and UPD Flood, but also VSE Flood and HTTP GET Requese Flood attacks.”

Indicators of Compromise

  • [MD5] Dropper files – 7e7694cfecf3e0809bcf28009cab4adb, 1cf392ce0c7fd5b56da8888c43a03be3
  • [MD5] Downloader/ PYbot components – 8fa445bbc93c43d5769038e56aeca84f, 827c83f08d1c139e4b6698bdcf386da8, 493b3bd39f89ed0d2f5ec3f175490b43
  • [MD5] Shortcut – 4db2035a98b270d485b95ea7cf417898
  • [FileName] nitrogen.exe, ntrg.exe, NitroGenerator.exe, p.exe, Windows_Defender.lnk
  • [URL] hxxp://75.119.139[.]66/p.exe – PYbot
  • [URL] hxxps://cdn.discordapp[.]com/attachments/1063947830827421708/1069081977828937728/Windows_Defender.lnk – Shortcut
  • [C2 URL] cnc.dotxyz[.]cf:666 – PYbot

Read more: https://asec.ahnlab.com/en/47789/