Extracted

Extracted

• • Target

    e9938f2d916c0fddd8230ac0241c4c42cf55ed5eb58e4b4ab6fb161000817559.exe

  • Size

    312KB

  • MD5

    f9cd86ed372b9fda0ca24ed082b4a742

  • SHA1

    b9a7bc7e10d3a6272acb3646fb31f5f2672e54f0

  • SHA256

    e9938f2d916c0fddd8230ac0241c4c42cf55ed5eb58e4b4ab6fb161000817559

  • SHA512

    2ef77bf6bfacd8f31c587a4fad9da8e9067abe0dc670764cad020e8bfea68a17ea4483a6878a2a40c195f6c2ab93faa46cf9947440a47ccaeb774db5f823c5dd

  • SSDEEP

    3072:fjMaOxcaTL6oaxJ2Hhom98iQ0txmYej1/PXzVHDVN/c5/yiT9laARTYFkc:fqxnLlav2BFKytLk1XXzVjVEDT0Fk

  Score

  10^/10

  smokeloaderpub1backdoorevasiontrojanbetabotbotnetpersistence

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot

  • Modifies firewall policy service

    evasion

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Sets file execution options in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2