General

  • Target

    3c1a54770a2da1df7c9e99fb29aafe7ac2299bcd8e0cc28d74f8f4fcc0fbef53

  • Size

    695KB

  • Sample

    220703-khvajaedd6

  • MD5

    3c802a9e6397b8acdf6e24e43fad5914

  • SHA1

    3794f38c8a3e1f0325f7e22098bb1cb35001d852

  • SHA256

    3c1a54770a2da1df7c9e99fb29aafe7ac2299bcd8e0cc28d74f8f4fcc0fbef53

  • SHA512

    bbc75e7508d805ab7c07a250c74c69499ee2034ddf8b15f70b71727bcfbe21ee7102f854d4cedf1978cf623c2757771ca3d3711d48d16164317e07465d313cdd

Malware Config

Targets

    • Target

      3c1a54770a2da1df7c9e99fb29aafe7ac2299bcd8e0cc28d74f8f4fcc0fbef53

    • Size

      695KB

    • MD5

      3c802a9e6397b8acdf6e24e43fad5914

    • SHA1

      3794f38c8a3e1f0325f7e22098bb1cb35001d852

    • SHA256

      3c1a54770a2da1df7c9e99fb29aafe7ac2299bcd8e0cc28d74f8f4fcc0fbef53

    • SHA512

      bbc75e7508d805ab7c07a250c74c69499ee2034ddf8b15f70b71727bcfbe21ee7102f854d4cedf1978cf623c2757771ca3d3711d48d16164317e07465d313cdd

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

    • Modifies firewall policy service

    • Sets file execution options in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Defense Evasion

Modify Registry

6
T1112

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Tasks