Overview

overview

10

Static

static

Factura_pdf.exe

windows7_x64

10

Factura_pdf.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Factura_pdf.zip

  • Size

    264KB

  • Sample

    200915-1kzfn9z4r6

  • MD5

    9ddc6d80c34c441d7de24ec7aca241bc

  • SHA1

    a2ef888b3d6f7a49b60865d33f684c256d7abc83

  • SHA256

    6a807112c53f2e0d82f5f28fe24a9bc01523375b18afecaa06b6e913078292a1

  • SHA512

    e77e91cbef69328e7278c5a8ae96cd75c231f76d958125f2b32652c705b4d57766dad0b5a8ee44b934ce7a12af0983fc8c2de6cea13b069db58d7e4de57999e4

Score
10/10
betabotbackdoorbotnetevasionpersistencetrojan

Malware Config

Targets

    • Target

      Factura_pdf.exe

    • Size

      349KB

    • MD5

      b96a97907b0f43cc35ff18e5c55f7cf6

    • SHA1

      2263f56daa58e9db1d63861d95b0ea3885776dd9

    • SHA256

      5dbe0969242db97b46ca8843b25d14148a5b17134937eef459c6560e7efd5c50

    • SHA512

      020006aa5337285f775021ff85977c2278a677fd7d3bfd9a8e8040e0b935064ab022c776f6de264119080bd60662bdbf46fd4a0e1cb292aeec0c0ed6d113b6dd

    Score
    10/10
    trojanbackdoorbotnetbetabotevasionpersistence

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

      trojanbackdoorbotnetbetabot

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks