betabot

General

Target

6d41078fc6798a5834e018a2e63be0cc
Size

3.3MB
Sample

240121-n5kamaccfr
MD5

6d41078fc6798a5834e018a2e63be0cc
SHA1

52ef8dea49e7ff8fbb8936bf04aacb9cb02190ee
SHA256

287b45f0e674bc427c8c0ef423af43a8c5d99973c5740e907995a0b771626be2
SHA512

191438b8d9bcef8b6004cfc9df231f7cca0bc113311fd2d662a263bd8f22b4bda7ac9be0201942c6d6a648b36db2e9a8a0b127ad60ccc6e88204e3265d8f3198
SSDEEP

49152:9gkIR3Djge8pLA/kncr/N1eCpKSUb5PaLP4gO/YPCQRz/1QAui7f3ViKDay5NKo7:ykK3Dw5U1eoWA8//adR1uiZXDay5NKo7

Score

10^/10

Malware Config

Extracted

Family

nullmixer

C2

http://hsiens.xyz/

Extracted

Family

privateloader

C2

http://37.0.10.214/proxies.txt

http://37.0.10.244/server.txt

http://wfsdragon.ru/api/setStats.php

37.0.10.237

Extracted

Family

vidar

Version

40.1

Botnet

706

C2

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32

Extracted

Family

gozi

Targets

- Target
  
  6d41078fc6798a5834e018a2e63be0cc
- Size
  
  3.3MB
- MD5
  
  6d41078fc6798a5834e018a2e63be0cc
- SHA1
  
  52ef8dea49e7ff8fbb8936bf04aacb9cb02190ee
- SHA256
  
  287b45f0e674bc427c8c0ef423af43a8c5d99973c5740e907995a0b771626be2
- SHA512
  
  191438b8d9bcef8b6004cfc9df231f7cca0bc113311fd2d662a263bd8f22b4bda7ac9be0201942c6d6a648b36db2e9a8a0b127ad60ccc6e88204e3265d8f3198
- SSDEEP
  
  49152:9gkIR3Djge8pLA/kncr/N1eCpKSUb5PaLP4gO/YPCQRz/1QAui7f3ViKDay5NKo7:ykK3Dw5U1eoWA8//adR1uiZXDay5NKo7
Score

10^/10

betabot nullmixer privateloader smokeloader vidar 706 aspackv2 backdoor botnet dropper evasion loader persistence stealer trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Disables taskbar notifications via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2
- Target
  
  setup_installer.exe
- Size
  
  3.3MB
- MD5
  
  8f1b3c374a82f6d44230cab96101b182
- SHA1
  
  68a67b0ce5365138bf8bdc2347920ca6658b4342
- SHA256
  
  7d3f519f1043f671ae6227a1c00e971f84fd466f665f5866abdc8bd74ebe7eb9
- SHA512
  
  2089f71a2f2fb9025e4ad3a2113f91235d6af8730d4275ccd0a65d2bd5676b79ccf9f57efd7f8bd8d4299d2e81a46319de9c19fa72fc6c3b734cf126711e020f
- SSDEEP
  
  98304:xMCvLUBsg+CDUhnkUAac7A+DUf+WJX8fn:xRLUCgdUhLAPWJMf
Score

10^/10

betabot gozi nullmixer privateloader smokeloader vidar 706 aspackv2 backdoor banker botnet dropper evasion isfb loader persistence stealer trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- Vidar Stealer
  stealer
- Disables taskbar notifications via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Looks for VMWare services registry key.
  evasion
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4