Extracted

Extracted

• • Target
    8f951988acb3a0d53fe2d66cfd60b7a0.exe
  • Size 205KB
  • SHA256 9024a473b6244e9aef3f65da784300194ff67434a204b445e5099ea80c19f949
  • MD5 8f951988acb3a0d53fe2d66cfd60b7a0
  • SHA1 9c39e8de9925b1102c39cbaabd01839c7e0c2e3e
  • SHA512 8bc796f9f523d20d2fc10d36ba8fa60bf0e412733b75ee0bfcc82716f3d6fbe86b0af614f885d5f294694ebd60f1e74040b7ad044357896a5611821b69ce30e8
  • SSDEEP 3072:EdrEskahJisaAN0yunrtMxxFF3m7SfdBm2HQWRlMuqBL2A:kEskaFVunrqvldBcz+
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  betabotsmokeloaderpub1backdoorbotnetevasionpersistencetrojan

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot

  • Modifies firewall policy service

    evasion

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Sets file execution options in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Executes dropped EXE

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2