Extracted

Extracted

• • Target

    e5b01cd00c400a4587db5d160b1380baf51684deed80b49934bcaf00bd9796aa.exe

  • Size

    311KB

  • MD5

    ad3d9d31919b2727b2a4678d3c37affd

  • SHA1

    1044bf1d3ac8b6193541acbbb4a0e576854cc8f1

  • SHA256

    e5b01cd00c400a4587db5d160b1380baf51684deed80b49934bcaf00bd9796aa

  • SHA512

    5c645773e7f1bdd12bfe65442b277d24aedd7bcd3ef80b91e4f3e720dc4bd07ce0e51edf7e70c2c7ec767ad5bc6cefbef5be3d7e8092ddbd3f09a02d354c64fd

  • SSDEEP

    3072:IT8Sq3LCwn/MOozAPDRK3ZCQXd0odbHLIviqj365uSR3lDbo5k9I3V2DaFwj0:mfSLChTAP1qCQXdF9rIvVSRLm3gb

  Score

  10^/10

  betabotsmokeloaderup3backdoorbotnetevasionpersistencetrojan

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot

  • Modifies firewall policy service

    evasion

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Sets file execution options in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2