Overview

overview

10

Static

static

54dbfdb9c7...8c.exe

windows7-x64

10

54dbfdb9c7...8c.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    54dbfdb9c79902b7c4d8e912e23208076551e14c9bb3531f4ff2486df390ef8c

  • Size

    659KB

  • Sample

    220725-wdngzaghd9

  • MD5

    21656ef176bee004042a3439b37d4159

  • SHA1

    1e8b981b43a753a8fadd68138a46544ea860488e

  • SHA256

    54dbfdb9c79902b7c4d8e912e23208076551e14c9bb3531f4ff2486df390ef8c

  • SHA512

    f58560d20650335dfb9382f0400b6ffe2c37788385e55188342a581814f7ac24fef29bd95107dfbe307828b7c4cc40f5668d0abba187d9ca36b9f9498ecc1cfe

Score
10/10
betabotbackdoorbotnetevasionpersistencetrojan

Malware Config

Targets

    • Target

      54dbfdb9c79902b7c4d8e912e23208076551e14c9bb3531f4ff2486df390ef8c

    • Size

      659KB

    • MD5

      21656ef176bee004042a3439b37d4159

    • SHA1

      1e8b981b43a753a8fadd68138a46544ea860488e

    • SHA256

      54dbfdb9c79902b7c4d8e912e23208076551e14c9bb3531f4ff2486df390ef8c

    • SHA512

      f58560d20650335dfb9382f0400b6ffe2c37788385e55188342a581814f7ac24fef29bd95107dfbe307828b7c4cc40f5668d0abba187d9ca36b9f9498ecc1cfe

    Score
    10/10
    betabotbackdoorbotnetevasionpersistencetrojan

    • BetaBot

      Beta Bot is a Trojan that infects computers and disables Antivirus.

      trojanbackdoorbotnetbetabot

    • Modifies firewall policy service

      evasion

    • Sets file execution options in registry

      persistence

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks