Highlights:

• Check Point Research (CPR) provides an in-depth analysis of the new malware strain dubbed BundleBot spreading under the radar


• BundleBot is abusing the dotnet bundle (single-file), self-contained format that results in very low or no static detection at all


• Commonly distributed via Facebook Ads and compromised accounts leading to websites masquerading as regular program utilities, AI tools, and games


• CPR introduces several techniques that were approved to be effective for reverse engineering the dotnet bundle (single-file), self-contained format

Introduction …

abusing accounts ads analysis bundle check check point compromised compromised accounts detection distributed dotnet facebook facebook ads file low malware malware analysis own point radar research results single stealer under under the radar websites