Extracted

Extracted

• • Target

    5308d1e75211592537867a6da16505c9

  • Size

    173KB

  • MD5

    5308d1e75211592537867a6da16505c9

  • SHA1

    7760cdf681fc8969bfdd9fb9b7b5b625ca31f1bd

  • SHA256

    b7ca91d094b124c955a6759efb9e7b5744775269345908643d8c8f48adbde879

  • SHA512

    9fb3ccf71fe4c600af9fb90aef63235121d28003dfafb79c928ba6ae55dadf527d3c833ef6201c045584ff91a8a0db45f9e23c7838094a302ee2038952d42ba3

  • SSDEEP

    3072:30ywvRswzkVZj+Yfi5D0b6HwhZoWC9sI5/DuT61m:3aZswwAX0b6HwhZU9sI5/

  Score

  10^/10

  betabotgozismokeloaderbackdoorbankerbotnetevasionisfbpersistencetrojan

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Disables taskbar notifications via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Sets file execution options in registry

    persistence

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2