Extracted

Extracted

• • Target

    4e6382c57e7df0854d89bc6b5d92f3b57a2a66046242e2464249af03a8314196.exe

  • Size

    312KB

  • MD5

    bdb4372ce468d3a760ae3a1b10e13edc

  • SHA1

    a61c1c086e5f3a2fa5f0a4ba4ea4ce7c3b655bc1

  • SHA256

    4e6382c57e7df0854d89bc6b5d92f3b57a2a66046242e2464249af03a8314196

  • SHA512

    70ae62f09ecf5410689b49e4a26eabaa756e06b39f9cb465e8f63c43942adaf3f3d7fc8acfac1b571e8fa3b08d997b3613e1f8b0de69f67a7386cf136410f8c3

  • SSDEEP

    3072:B8EGKLRYyi5SE5SjT6MqYb0XGRIbjxS+ob56o3M05sgB4QbPF:BljLRf/PKas5blFemdc/N

  Score

  10^/10

  betabotsmokeloaderup3backdoorbotnetevasionpersistencetrojan

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Disables taskbar notifications via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Sets file execution options in registry

    persistence

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2