Extracted

Extracted

• • Target

    8f951988acb3a0d53fe2d66cfd60b7a0.exe

  • Size

    205KB

  • MD5

    8f951988acb3a0d53fe2d66cfd60b7a0

  • SHA1

    9c39e8de9925b1102c39cbaabd01839c7e0c2e3e

  • SHA256

    9024a473b6244e9aef3f65da784300194ff67434a204b445e5099ea80c19f949

  • SHA512

    8bc796f9f523d20d2fc10d36ba8fa60bf0e412733b75ee0bfcc82716f3d6fbe86b0af614f885d5f294694ebd60f1e74040b7ad044357896a5611821b69ce30e8

  • SSDEEP

    3072:EdrEskahJisaAN0yunrtMxxFF3m7SfdBm2HQWRlMuqBL2A:kEskaFVunrqvldBcz+

  Score

  10^/10

  betabotsmokeloaderpub1backdoorbotnetevasionpersistencetrojan

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot

  • Modifies firewall policy service

    evasion

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Sets file execution options in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself

  • Executes dropped EXE

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2