white-papers-win-32-carberp.pdf

ESET/Group-IB provide a technical analysis of Win32/Carberp evolving to include a kernel-mode bootkit (Zerokit/Rovnix), its installer and privilege-escalation exploits (MS10-073, MS10-092, MS11-011, .NET vuln), distribution via Black Hole exploit kit (notably Java exploits), C2/debug logs, plugin architecture for targeting Russian remote banking systems, and related malware (SpyEye) and criminal ecosystem activity.