General

  • Target

    DE8F95DDE4E2520F4D1F94943F3F995FCBCBA9D0E55F0.exe

  • Size

    693KB

  • Sample

    220508-fe4btafdf5

  • MD5

    bd1997f2a1d64db6288b68ea2c93774d

  • SHA1

    04a292a94611c7882d20c05cd684eb33ce5d80e7

  • SHA256

    de8f95dde4e2520f4d1f94943f3f995fcbcba9d0e55f0f7f9f83e0399bd3739f

  • SHA512

    0890b1a0f17e9f49ab2e5edd77324ca0fd47d26f32954893f8be90f2bff9787f6811a37b5cc21fa9ed2a927137de40e10b34dfccc2736bda54f6552d56781341

Malware Config

Targets

    • Target

      DE8F95DDE4E2520F4D1F94943F3F995FCBCBA9D0E55F0.exe

    • Size

      693KB

    • MD5

      bd1997f2a1d64db6288b68ea2c93774d

    • SHA1

      04a292a94611c7882d20c05cd684eb33ce5d80e7

    • SHA256

      de8f95dde4e2520f4d1f94943f3f995fcbcba9d0e55f0f7f9f83e0399bd3739f

    • SHA512

      0890b1a0f17e9f49ab2e5edd77324ca0fd47d26f32954893f8be90f2bff9787f6811a37b5cc21fa9ed2a927137de40e10b34dfccc2736bda54f6552d56781341

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

    • Modifies firewall policy service

    • Sets file execution options in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v6

Tasks