Newest addition to a happy family: KBOT

This report analyzes a spam campaign that delivers a JavaScript dropper which downloads a modified KBOT/Carberp-derived banking trojan. The malware exhibits Tor support, HMAC-protected messaging, a more complex encryption scheme, and an embedded mongoose HTTP server; the author extracts configuration structure and provides domains, file hashes, and a YARA rule for detection.