betabot | ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2 | Triage

Submit
Reports

Overview

overview

Static

static

3

winprofile

windows7-x64

winprofile

windows10-1703-x64

1

Sharing

General

Target

ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2
Size

360KB
Sample

240114-2bnb3sddck
MD5

0c819dd27a128d9234daa3d772fb8c20
SHA1

d5d36492818872da8e70dc28cc85389b8e0f3819
SHA256

ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2
SHA512

f502ddb79703297cf0592e68c3f1f964584725d7aa670272998f174ffa108bb7340c0d65d38d69e1b3f7f1217628dadda108fa2d5fe1eab73b7b3302b9f769b7
SSDEEP

6144:oTEEmSQlsdFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:EpjFkRTOzEV6zs1hfk8oYVd+Dj4mYVds

Score

10^/10

betabot backdoor botnet evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2.exe

Resource

win7-20231215-en

betabot backdoor botnet evasion persistence trojan

windows7-x64

28 signatures

300 seconds

Behavioral task

behavioral2

Sample

ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2.exe

Resource

win10-20231215-en

windows10-1703-x64

0 signatures

300 seconds

Malware Config

Targets

- Target
  
  ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2
- Size
  
  360KB
- MD5
  
  0c819dd27a128d9234daa3d772fb8c20
- SHA1
  
  d5d36492818872da8e70dc28cc85389b8e0f3819
- SHA256
  
  ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2
- SHA512
  
  f502ddb79703297cf0592e68c3f1f964584725d7aa670272998f174ffa108bb7340c0d65d38d69e1b3f7f1217628dadda108fa2d5fe1eab73b7b3302b9f769b7
- SSDEEP
  
  6144:oTEEmSQlsdFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:EpjFkRTOzEV6zs1hfk8oYVd+Dj4mYVds
Score

10^/10

betabot backdoor botnet evasion persistence trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Disables taskbar notifications via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

Software Discovery

Security Software Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

betabotbackdoorbotnetevasionpersistencetrojan

behavioral2

© 2018-2024

Terms | Privacy