Extracted

Extracted

• • Target

    990a6d8f565a8df63234c7a9faabe6ba.exe

  • Size

    290KB

  • MD5

    990a6d8f565a8df63234c7a9faabe6ba

  • SHA1

    328558357bbbafd16fad998fabb4e03c328900e9

  • SHA256

    db726961f1431fd7343b23e90a146a7fd19233d4980815f2d68d50c36bc1175d

  • SHA512

    2ae5bc20ee6b6a91662cc3d49433c7354fb8a0f3bdfb224d5da2820e6e637fb886279d6fca0b17bafa5bf991dfa9a3a4179ae9f9ba09b3f8bb04f626ea8eeabe

  • SSDEEP

    3072:jec4fYwGFV04Lr70+sJiaUEvhqwuFVEYWQzkWl+tyYA5gi9/6NmJ5b4cQ4bRXp6h:jec43GFV04LNzEw9EYW8+lA/6+bRXMA

  Score

  10^/10

  smokeloaderup3backdoorevasiontrojanbetabotbotnetpersistence

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot

  • Modifies firewall policy service

    evasion

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Sets file execution options in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2