General

  • Target

    div.exe

  • Size

    476KB

  • Sample

    200904-kj6shhfdce

  • MD5

    1fab5b2e8a75f5e6d0ab336c75a45d3e

  • SHA1

    a77526cc5cdf4ea8abb31a6324c2282f1db351c9

  • SHA256

    973b3d66cf3f04d5be0e10dfa5ab24fbc8c5d2b58cc5728d81a448dbe079f4e6

  • SHA512

    a47e0ad3700c1005064170964ae3e3e09d63f9a08e3723f1a880023f5333a53d85859ed866570e14e03283664514b35c3d588761d07413b1261de70ab5a52508

Malware Config

Targets

    • Target

      div.exe

    • Size

      476KB

    • MD5

      1fab5b2e8a75f5e6d0ab336c75a45d3e

    • SHA1

      a77526cc5cdf4ea8abb31a6324c2282f1db351c9

    • SHA256

      973b3d66cf3f04d5be0e10dfa5ab24fbc8c5d2b58cc5728d81a448dbe079f4e6

    • SHA512

      a47e0ad3700c1005064170964ae3e3e09d63f9a08e3723f1a880023f5333a53d85859ed866570e14e03283664514b35c3d588761d07413b1261de70ab5a52508

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

    • Modifies firewall policy service

    • Sets file execution options in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Drops desktop.ini file(s)

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

4
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Tasks