betabot

General

Target

toolspub2.exe
Size

255KB
Sample

240116-bsdabsadej
MD5

981b36d1cfeefa91f3ef5332922cdd8d
SHA1

b8a6b27e011a503755c6df2501039edb82b092aa
SHA256

461f0f86f52bfa5fbed84023d0a9c8652bcbca34fea76ad0cb5bb8c503b65c9a
SHA512

e0932850586027a24b8d8d7a3fbbaf4fc466a89cc4382ca1fb31847b5c201df3855f31e7208c577cc7907e5af0792abff0092941774cf3b4a27256440ba0d7c2
SSDEEP

3072:2lrJL/wx7/zm4XobcY66bIjWMHGZ4jnz2fbqbzx5h+4Wy601:23L/wxf9Y6mIjN/nmI+4W1

Score

10^/10

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes

extension
.cdpo
offline_id
Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0844OSkw

rsa_pubkey.plain

Targets

- Target
  
  toolspub2.exe
- Size
  
  255KB
- MD5
  
  981b36d1cfeefa91f3ef5332922cdd8d
- SHA1
  
  b8a6b27e011a503755c6df2501039edb82b092aa
- SHA256
  
  461f0f86f52bfa5fbed84023d0a9c8652bcbca34fea76ad0cb5bb8c503b65c9a
- SHA512
  
  e0932850586027a24b8d8d7a3fbbaf4fc466a89cc4382ca1fb31847b5c201df3855f31e7208c577cc7907e5af0792abff0092941774cf3b4a27256440ba0d7c2
- SSDEEP
  
  3072:2lrJL/wx7/zm4XobcY66bIjWMHGZ4jnz2fbqbzx5h+4Wy601:23L/wxf9Y6mIjN/nmI+4W1
Score

10^/10

betabot smokeloader up3 backdoor botnet evasion persistence trojan djvu discovery ransomware
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Detected Djvu ransomware
- Djvu Ransomware
  Ransomware which is a variant of the STOP family.
  ransomware djvu
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Disables taskbar notifications via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Downloads MZ/PE file
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2