betabot

General

Target

6845d02328fb5e5e5944acd141d2b088
Size

2.5MB
Sample

240119-wjmsmabed3
MD5

6845d02328fb5e5e5944acd141d2b088
SHA1

5d04f7bbd56dd67612d79a6fbcfddb1888cd1c8e
SHA256

45c04168fe1e27939f2e08c178279d8c1aca5eba4ed8f6a717eb70b966cc5617
SHA512

4e81fd2117635ecefb2943953e805cbe2416c98b75c40d421dd7f13e3f014d7941bea24820b9359cd5c1fcb18043c8ca688e5bd171ee029b651157d39d02eb4b
SSDEEP

49152:9gBjHAC8QDo0NcMpwz+Qern2gMA9q9GABB3rI+vylIeRt9ipgJ:yhHA2caIzdernXJq9FJeRypgJ

Score

10^/10

Malware Config

Extracted

Family

nullmixer

C2

http://sornx.xyz/

Extracted

Family

privateloader

C2

http://37.0.10.214/proxies.txt

http://37.0.10.244/server.txt

http://wfsdragon.ru/api/setStats.php

37.0.10.237

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32

Extracted

Family

vidar

Version

40.1

Botnet

706

C2

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Extracted

Family

gozi

Targets

- Target
  
  6845d02328fb5e5e5944acd141d2b088
- Size
  
  2.5MB
- MD5
  
  6845d02328fb5e5e5944acd141d2b088
- SHA1
  
  5d04f7bbd56dd67612d79a6fbcfddb1888cd1c8e
- SHA256
  
  45c04168fe1e27939f2e08c178279d8c1aca5eba4ed8f6a717eb70b966cc5617
- SHA512
  
  4e81fd2117635ecefb2943953e805cbe2416c98b75c40d421dd7f13e3f014d7941bea24820b9359cd5c1fcb18043c8ca688e5bd171ee029b651157d39d02eb4b
- SSDEEP
  
  49152:9gBjHAC8QDo0NcMpwz+Qern2gMA9q9GABB3rI+vylIeRt9ipgJ:yhHA2caIzdernXJq9FJeRypgJ
Score

10^/10

betabot gozi nullmixer privateloader smokeloader vidar 706 aspackv2 backdoor banker botnet dropper evasion isfb loader persistence stealer trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Disables taskbar notifications via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Looks for VMWare services registry key.
  evasion
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  setup_installer.exe
- Size
  
  2.5MB
- MD5
  
  166f2bc8f7949c714210d8b0aad0e30f
- SHA1
  
  3a17e35120b1b6d9af676331288f7763b2a38252
- SHA256
  
  568b3a7273ccbb1436e42dd90f0541d7dc0da2a97944381ad0b31d7d437c4908
- SHA512
  
  144f45e98c9fede9067aabcc2a3af50603ce4cb519a06bfb94f6b93d47a6c5c70231278af240c9e7532b7b04c7c1670747b650f8e4e1f056401058784c7d8da6
- SSDEEP
  
  49152:xcBFuWMmtRozSLa2D5nPv2UdgCn8mhTRxtVxOmD2hiiAjIoUpD9ywFbG0J1k8ji:xu6KzlV6ozTFODDFoQRywFbG0J1kOi
Score

10^/10

betabot gozi nullmixer privateloader smokeloader vidar 706 aspackv2 backdoor banker botnet dropper evasion isfb loader persistence stealer trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Disables taskbar notifications via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4