Extracted

Extracted

• • Target
    e9938f2d916c0fddd8230ac0241c4c42cf55ed5eb58e4b4ab6fb161000817559
  • Size 312KB
  • SHA256 e9938f2d916c0fddd8230ac0241c4c42cf55ed5eb58e4b4ab6fb161000817559
  • MD5 f9cd86ed372b9fda0ca24ed082b4a742
  • SHA1 b9a7bc7e10d3a6272acb3646fb31f5f2672e54f0
  • SHA512 2ef77bf6bfacd8f31c587a4fad9da8e9067abe0dc670764cad020e8bfea68a17ea4483a6878a2a40c195f6c2ab93faa46cf9947440a47ccaeb774db5f823c5dd
  • SSDEEP 3072:fjMaOxcaTL6oaxJ2Hhom98iQ0txmYej1/PXzVHDVN/c5/yiT9laARTYFkc:fqxnLlav2BFKytLk1XXzVjVEDT0Fk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  betabotsmokeloaderpub1backdoorbotnetevasionpersistencetrojan

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot

  • Modifies firewall policy service

    evasion

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Sets file execution options in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2