betabot

General

Target

720ac82bbf6ae7c41ea0630be8a40710
Size

3.7MB
Sample

240124-mzd1zsgdh4
MD5

720ac82bbf6ae7c41ea0630be8a40710
SHA1

210b371d8c3d4e1bc3e913173207590ec41c7710
SHA256

5bbc833edf2e7c061fd34fe1aba85ff56746dbe0875eafcc945c264ac45193ae
SHA512

f7873235e0b9a68e1f411864117662c790c738b6e4b2af3453b57d271e29d6e0a073664df862cb82e259eb6a888a945104816ea39113f8c2841ccd955bb03c31
SSDEEP

49152:9gxFlcj5VXxQ4Ql8k5YPvMsv2T7zQiyBEGAgBiILY6kX6Xovi8pHPu8YiW1SQ845:yfUhOVYPTWQpPAOiIUne5sPukE9AtbsR

Malware Config

Extracted

Family

nullmixer

C2

http://sornx.xyz/

Extracted

Family

privateloader

C2

http://37.0.10.214/proxies.txt

http://37.0.10.244/server.txt

http://wfsdragon.ru/api/setStats.php

37.0.10.237

Extracted

Family

vidar

Version

40.1

Botnet

706

C2

https://eduarroma.tumblr.com/

Attributes

profile_id
706

Extracted

Family

gcleaner

C2

194.145.227.161

Extracted

Family

smokeloader

Version

2020

C2

http://varmisende.com/upload/

http://fernandomayol.com/upload/

http://nextlytm.com/upload/

http://people4jan.com/upload/

http://asfaltwerk.com/upload/

rc4.i32

Extracted

Family

gozi

Targets

- Target
  
  720ac82bbf6ae7c41ea0630be8a40710
- Size
  
  3.7MB
- MD5
  
  720ac82bbf6ae7c41ea0630be8a40710
- SHA1
  
  210b371d8c3d4e1bc3e913173207590ec41c7710
- SHA256
  
  5bbc833edf2e7c061fd34fe1aba85ff56746dbe0875eafcc945c264ac45193ae
- SHA512
  
  f7873235e0b9a68e1f411864117662c790c738b6e4b2af3453b57d271e29d6e0a073664df862cb82e259eb6a888a945104816ea39113f8c2841ccd955bb03c31
- SSDEEP
  
  49152:9gxFlcj5VXxQ4Ql8k5YPvMsv2T7zQiyBEGAgBiILY6kX6Xovi8pHPu8YiW1SQ845:yfUhOVYPTWQpPAOiIUne5sPukE9AtbsR
Score

10^/10

betabot fabookie gcleaner nullmixer onlylogger privateloader smokeloader vidar 706 aspackv2 backdoor botnet dropper evasion loader persistence spyware stealer trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Detect Fabookie payload
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- OnlyLogger payload
- Vidar Stealer
  stealer
- Disables taskbar notifications via registry modification
  evasion
- Disables use of System Restore points
  evasion
- Looks for VMWare services registry key.
  evasion
- Sets file execution options in registry
  persistence
- Sets service image path in registry
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  setup_installer.exe
- Size
  
  3.7MB
- MD5
  
  184a87b6c0950b2a03dab882d36c661c
- SHA1
  
  8121404e64b7affa682841b997bddc323de85b82
- SHA256
  
  62da5ae01c896c19893b4540a249b3c3d7d2523b06fe083583994469a91db8f9
- SHA512
  
  117b7b4e6fd1380d257027852e4cfab4f506cd5bf041c5b0fcaf4a9784a5e2cacdec1904b9e512e37e2d8f0c924f985b207640ca2e77f1ad37731dde47d32096
- SSDEEP
  
  98304:xRCvLUBsgEbZDBRTOQfEA8lWfii12HJ9z/7xuEeqnr:x6LUCgmZDzqQrvwHJFB7
Score

10^/10

betabot fabookie gcleaner gozi nullmixer onlylogger privateloader smokeloader vidar 706 aspackv2 backdoor banker botnet dropper evasion isfb loader persistence spyware stealer trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Detect Fabookie payload
- Fabookie
  Fabookie is facebook account info stealer.
  spyware stealer fabookie
- GCleaner
  GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
  loader gcleaner
- Gozi
  Gozi is a well-known and widely distributed banking trojan.
  banker trojan gozi
- Modifies firewall policy service
  evasion
- NullMixer
  NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
  dropper nullmixer
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- PrivateLoader
  PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
  loader privateloader
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Vidar
  Vidar is an infostealer based on Arkei stealer.
  stealer vidar
- OnlyLogger payload
- Vidar Stealer
  stealer
- Looks for VMWare services registry key.
  evasion
- Sets file execution options in registry
  persistence
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral3 behavioral4