Overview

overview

10

Static

static

ฺฺฺK...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

test

windows7_x64

10

ฺฺฺ....ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

Resubmissions

15-02-2021 10:32

210215-rbd8jp8by2 10

15-02-2021 10:26

210215-1va7r5ahjn 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901.zip

  • Size

    562KB

  • Sample

    210215-rbd8jp8by2

  • MD5

    3df357517581e10e783e463ba15cd99b

  • SHA1

    68114772bcdfcc01b5f3272c7188658f3a5da32d

  • SHA256

    ccab681baa683fa5d1bc2c11f786b67800eca96442ace9372c8dd5d31b5366e2

  • SHA512

    b15cce78b00c47c48b47ebe131affa4a794e1cee2bf7850afdc304a3c57fd18c9897a502dee545160ecd8c78f0392047158785fe8b82d5ea35d7cafe7e807f49

Score
10/10
betabotbackdoorbotnetevasionpersistencetrojan

Malware Config

Targets

    • Target

      e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901

    • Size

      698KB

    • MD5

      f3e344b63fd98041b0551c0a329e85fb

    • SHA1

      ac086b6e0b21648088c8d098c68adfab38927e61

    • SHA256

      e0a124e431d01bf7b194ad5a2f8c0435471c0e1b062e165c3db211186a1ea901

    • SHA512

      7ead065043f00dee8654f10c358448c9521a2825036cf4c09fbc9f334c9d3815f1cbaae722757968d1347f394da58fbd8aa35ac87c221079cdf0a765af0dfc5a

    Score
    10/10
    betabotbackdoorbotnetevasionpersistencetrojan

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

      trojanbackdoorbotnetbetabot

    • Modifies firewall policy service

      evasion

    • Executes dropped EXE

    • Sets file execution options in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates physical storage devices

      Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2behavioral3behavioral4behavioral5

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

5
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks