betabot | ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2 | Triage

Submit
Reports

Overview

overview

Static

static

3

winprofile

windows7-x64

winprofile

windows10-1703-x64

1

Sharing

General

Target

ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2
Size

360KB
Sample

240129-fkaxfsaed8
MD5

0c819dd27a128d9234daa3d772fb8c20
SHA1

d5d36492818872da8e70dc28cc85389b8e0f3819
SHA256

ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2
SHA512

f502ddb79703297cf0592e68c3f1f964584725d7aa670272998f174ffa108bb7340c0d65d38d69e1b3f7f1217628dadda108fa2d5fe1eab73b7b3302b9f769b7
SSDEEP

6144:oTEEmSQlsdFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:EpjFkRTOzEV6zs1hfk8oYVd+Dj4mYVds

Score

10^/10

betabot backdoor botnet evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2.exe

Resource

win7-20231129-en

betabot backdoor botnet evasion persistence trojan

windows7-x64

23 signatures

300 seconds

Behavioral task

behavioral2

Sample

ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2.exe

Resource

win10-20231215-en

windows10-1703-x64

0 signatures

300 seconds

Malware Config

Targets

- Target
  
  ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2
- Size
  
  360KB
- MD5
  
  0c819dd27a128d9234daa3d772fb8c20
- SHA1
  
  d5d36492818872da8e70dc28cc85389b8e0f3819
- SHA256
  
  ae088798b181a2bf822fcd3bec3a11779f45a8e3b83cb6c75c5ffbffc3c3d5b2
- SHA512
  
  f502ddb79703297cf0592e68c3f1f964584725d7aa670272998f174ffa108bb7340c0d65d38d69e1b3f7f1217628dadda108fa2d5fe1eab73b7b3302b9f769b7
- SSDEEP
  
  6144:oTEEmSQlsdFksgTOzEV6zs1hfk8MIcG1Zb7d+0PuSCU4CzmJkdVds:EpjFkRTOzEV6zs1hfk8oYVd+Dj4mYVds
Score

10^/10

betabot backdoor botnet evasion persistence trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Modifies firewall policy service
  evasion
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

betabotbackdoorbotnetevasionpersistencetrojan

behavioral2

© 2018-2024

Terms | Privacy