Extracted

Extracted

• • Target

    efe103f9ccf08971d6d42c0a20c59e64e64d02999cebe8a3247e74f8a0ea439f

  • Size

    213KB

  • MD5

    518fa1761d1903670c9c2a5cae38646d

  • SHA1

    bc735ff81eb03d5b2e93e4c6edc1a0bf303bcd1e

  • SHA256

    efe103f9ccf08971d6d42c0a20c59e64e64d02999cebe8a3247e74f8a0ea439f

  • SHA512

    a23723830cc4e1ffd271d75aa9abdabbe658ba9f47e81ec69a7b10a65024ec90d631097c878fd45526921de0b671120a603440e5d74f184507b632a95dcacd12

  • SSDEEP

    3072:SoMaibUPLJiUzDb2Q6weG7AkX6OSv+9pR5+:/ibUPnb2QveNk7+

  Score

  10^/10

  betabotsmokeloaderup3backdoorbotnetevasionpersistencetrojan

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot

  • Modifies firewall policy service

    evasion

  • Modifies security service

    evasion

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader

  • Disables taskbar notifications via registry modification

    evasion

  • Disables use of System Restore points

    evasion

  • Sets file execution options in registry

    persistence

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks for any installed AV software in registry

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops desktop.ini file(s)

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2