betabot | f62e3df884bb3d145652dda9f81b28d10a8a5047879568ac22eba899c5ecf194 | Triage

Submit
Reports

Overview

overview

Static

static

3

winprofile

windows7-x64

winprofile

windows10-1703-x64

1

Sharing

General

Target

f62e3df884bb3d145652dda9f81b28d10a8a5047879568ac22eba899c5ecf194
Size

360KB
Sample

231224-2vqasagegl
MD5

49c53c376d7ccb9391f4f75f20fba18a
SHA1

581e38a0331173c4638d2e536916a7a2805c9bc4
SHA256

f62e3df884bb3d145652dda9f81b28d10a8a5047879568ac22eba899c5ecf194
SHA512

865894203a5a70e893cae92bd40c241fd08681eb890890a4a866c6042afe67fb76755e981ebc8d8cdee91988cee33f718b662f8b554237b74d8cf0a55a6b1e84
SSDEEP

6144:AFlWqd4FksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:clWXFkRTOzEV6zs1hfk8oYVd+Dj4mYV+

Score

10^/10

betabot backdoor botnet evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

f62e3df884bb3d145652dda9f81b28d10a8a5047879568ac22eba899c5ecf194.exe

Resource

win7-20231215-en

betabot backdoor botnet evasion persistence trojan

windows7-x64

23 signatures

300 seconds

Behavioral task

behavioral2

Sample

f62e3df884bb3d145652dda9f81b28d10a8a5047879568ac22eba899c5ecf194.exe

Resource

win10-20231215-en

windows10-1703-x64

0 signatures

300 seconds

Malware Config

Targets

- Target
  
  f62e3df884bb3d145652dda9f81b28d10a8a5047879568ac22eba899c5ecf194
- Size
  
  360KB
- MD5
  
  49c53c376d7ccb9391f4f75f20fba18a
- SHA1
  
  581e38a0331173c4638d2e536916a7a2805c9bc4
- SHA256
  
  f62e3df884bb3d145652dda9f81b28d10a8a5047879568ac22eba899c5ecf194
- SHA512
  
  865894203a5a70e893cae92bd40c241fd08681eb890890a4a866c6042afe67fb76755e981ebc8d8cdee91988cee33f718b662f8b554237b74d8cf0a55a6b1e84
- SSDEEP
  
  6144:AFlWqd4FksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:clWXFkRTOzEV6zs1hfk8oYVd+Dj4mYV+
Score

10^/10

betabot backdoor botnet evasion persistence trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Modifies firewall policy service
  evasion
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

betabotbackdoorbotnetevasionpersistencetrojan

behavioral2

© 2018-2024

Terms | Privacy