Overview

overview

10

Static

static

41e7b169c5...e0.exe

windows7_x64

10

41e7b169c5...e0.exe

windows10-2004_x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41e7b169c52c8fb5f12655e024aded045aa2c09b72b8e0125648d1f0dc9a7ae0

  • Size

    520KB

  • Sample

    220708-etqtlabaf8

  • MD5

    81501d955a942bc4b12b6fb1df160a3d

  • SHA1

    1787ad490d9fa9aa29ce16b89743a1ba215fa251

  • SHA256

    41e7b169c52c8fb5f12655e024aded045aa2c09b72b8e0125648d1f0dc9a7ae0

  • SHA512

    1b4a3b95099eb5add4a8c9aad47d380640c95b5a83ee462f60f509575cdd85a6f9e9c4c01d07d6e5c88a9dc58842557133450003f4b1b42e3bb508350126f033

Score
10/10
betabotbackdoorbotnetevasionpersistencetrojan

Malware Config

Targets

    • Target

      41e7b169c52c8fb5f12655e024aded045aa2c09b72b8e0125648d1f0dc9a7ae0

    • Size

      520KB

    • MD5

      81501d955a942bc4b12b6fb1df160a3d

    • SHA1

      1787ad490d9fa9aa29ce16b89743a1ba215fa251

    • SHA256

      41e7b169c52c8fb5f12655e024aded045aa2c09b72b8e0125648d1f0dc9a7ae0

    • SHA512

      1b4a3b95099eb5add4a8c9aad47d380640c95b5a83ee462f60f509575cdd85a6f9e9c4c01d07d6e5c88a9dc58842557133450003f4b1b42e3bb508350126f033

    Score
    10/10
    betabotbackdoorbotnetevasionpersistencetrojan

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

      trojanbackdoorbotnetbetabot

    • Modifies firewall policy service

      evasion

    • Sets file execution options in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks