betabot | 8572f4becdc95089022caacfbccb17206f55b085dc6f0d25436a04d71202e557 | Triage

Submit
Reports

Overview

overview

Static

static

3

winprofile

windows7-x64

winprofile

windows10-1703-x64

1

Sharing

General

Target

8572f4becdc95089022caacfbccb17206f55b085dc6f0d25436a04d71202e557
Size

360KB
Sample

231224-2h3qcaecej
MD5

8e9859f020402fc117203cdf6c11cab7
SHA1

f6fbe4cc349b42a69c1eef2da288ccad5d6b49dd
SHA256

8572f4becdc95089022caacfbccb17206f55b085dc6f0d25436a04d71202e557
SHA512

13f5587011c837c74499aa5c6eea11cb37cf179059da85a37622671ff9ad862aec6d3b04387a6f74f943582fcd5037df4355b52516f8ec7967188bb28aa5c55b
SSDEEP

6144:ldRiIIdU4QdFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:7RiNdU4+FkRTOzEV6zs1hfk8oYVd+DjB

Score

10^/10

betabot backdoor botnet evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

8572f4becdc95089022caacfbccb17206f55b085dc6f0d25436a04d71202e557.exe

Resource

win7-20231129-en

betabot backdoor botnet evasion persistence trojan

windows7-x64

19 signatures

300 seconds

Behavioral task

behavioral2

Sample

8572f4becdc95089022caacfbccb17206f55b085dc6f0d25436a04d71202e557.exe

Resource

win10-20231215-en

windows10-1703-x64

0 signatures

300 seconds

Malware Config

Targets

- Target
  
  8572f4becdc95089022caacfbccb17206f55b085dc6f0d25436a04d71202e557
- Size
  
  360KB
- MD5
  
  8e9859f020402fc117203cdf6c11cab7
- SHA1
  
  f6fbe4cc349b42a69c1eef2da288ccad5d6b49dd
- SHA256
  
  8572f4becdc95089022caacfbccb17206f55b085dc6f0d25436a04d71202e557
- SHA512
  
  13f5587011c837c74499aa5c6eea11cb37cf179059da85a37622671ff9ad862aec6d3b04387a6f74f943582fcd5037df4355b52516f8ec7967188bb28aa5c55b
- SSDEEP
  
  6144:ldRiIIdU4QdFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:7RiNdU4+FkRTOzEV6zs1hfk8oYVd+DjB
Score

10^/10

betabot backdoor botnet evasion persistence trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Modifies firewall policy service
  evasion
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

betabotbackdoorbotnetevasionpersistencetrojan

behavioral2

© 2018-2024

Terms | Privacy