Extracted

Extracted

• • Target
    614bf403bf44d9ea97810d8a7e29197a.exe
  • Size 276KB
  • SHA256 d4ccf1fa78f6a843f2f2eb3ade48c9b486247b497fa54e3c9dc28f7c5ec7088d
  • MD5 614bf403bf44d9ea97810d8a7e29197a
  • SHA1 a6e16375267ca3756ff09c997940592e701d94b6
  • SHA512 8f1c20ab1eebb4dd5c7aa72b2a02d2d2e4cf8f4939d31d895fc069eff741f2796e15a11babfa2e71ea9a805d20b9b0994963da44cc2fc8d1367399d0cadabdeb
  • SSDEEP 6144:6sVtsSuLe88PBJb3d9tiQCegRGCiPUgp6l:68tsRJ8Pbb/tXCegRzsUgc
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  betabotsmokeloaderpub1backdoorbotnetevasionpersistencetrojan

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Disables taskbar notifications via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Sets file execution options in registry

    persistence

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2