betabot

Sharing

Copy URL

Twitter E-mail

General

Target

b9091ef41de734fdbd7c7df7b2a5ea20
Size

316KB
Sample

240307-sk54tafb9x
MD5

b9091ef41de734fdbd7c7df7b2a5ea20
SHA1

4d313c6379933dfcfc79cab04a7c83899862b0d7
SHA256

3ad3e9feca98bd1c94415f0319340c3c9416541f4592f7373aeeab289a03c7ac
SHA512

f3aa29e6d4f77d36d1d6a0da1d88e69e69af9bed81a63b85869b1d2582a3e5ff121b9ac8a8b33e2d3f329569fcc3c5370b23da3bdca5636db91c9b6a98813733
SSDEEP

6144:E1onIw+yeYJGW5jt6IAqQXkZ52XZFF64v9VXbBkl/TEJf5:soIwZ5HQ083FPlVX6p+f5

Score

10^/10

Malware Config

Targets

- Target
  
  b9091ef41de734fdbd7c7df7b2a5ea20
- Size
  
  316KB
- MD5
  
  b9091ef41de734fdbd7c7df7b2a5ea20
- SHA1
  
  4d313c6379933dfcfc79cab04a7c83899862b0d7
- SHA256
  
  3ad3e9feca98bd1c94415f0319340c3c9416541f4592f7373aeeab289a03c7ac
- SHA512
  
  f3aa29e6d4f77d36d1d6a0da1d88e69e69af9bed81a63b85869b1d2582a3e5ff121b9ac8a8b33e2d3f329569fcc3c5370b23da3bdca5636db91c9b6a98813733
- SSDEEP
  
  6144:E1onIw+yeYJGW5jt6IAqQXkZ52XZFF64v9VXbBkl/TEJf5:soIwZ5HQ083FPlVX6p+f5
Score

10^/10

betabot backdoor botnet evasion persistence trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Modifies firewall policy service
  evasion
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  b26b412d9f1050ad53f663c972fdcd9f
- SHA1
  
  7bc4ed444f3f8fd14c2c36784d828175bace8c17
- SHA256
  
  70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
- SHA512
  
  ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
- SSDEEP
  
  48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1
  
  fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA256
  
  fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- SHA512
  
  0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP
  
  192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  b3070cf20db659fdfb3cb2ed38130e8d
- SHA1
  
  aa234b0620bebddde1414ff6b0840d883890b413
- SHA256
  
  f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
- SHA512
  
  4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1
- SSDEEP
  
  96:oEqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx40qndYHnxss:oEq+CP3uKrpyREs06YxEdGn
Score

3^/10
behavioral7 behavioral8
- Target
  
  Uninstall_FoldingBrowser .exe
- Size
  
  71KB
- MD5
  
  8dd15bbaa635358aa8bb9af00cdf4e9c
- SHA1
  
  62dd57c30a1950d4558ee2d7189fa2836d188098
- SHA256
  
  51d1e2664649b716a8c73c314d6485b4edacec76ebe343bcfe6c0392caf2dd5d
- SHA512
  
  e55095f2b562ea8ddcd7e59749805ee696c25d44845de5df816354a0c6ff0ceec6641689b3175eb25109b6ec6a33b3d16420a265ecd40581b6c84e64d3fc660f
- SSDEEP
  
  1536:E1E/rzW2pakRmB7BW3nKsclgdLeAyN7Q4r7q4XdZ:E1E/rS2paccKntclceA/g7q4X3
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/LangDLL.dll
- Size
  
  5KB
- MD5
  
  b26b412d9f1050ad53f663c972fdcd9f
- SHA1
  
  7bc4ed444f3f8fd14c2c36784d828175bace8c17
- SHA256
  
  70c842f318f691d92e5829616a283aa9bf9dc18cea6f39bad028e176056b591a
- SHA512
  
  ba350a10b41c0cfe34c502e3d0e68fbfe1489448c85a282e0a5e444fa58d0dd8be2e566e21f0734a0debfc454f08b84140964c09c4c952f6a442642c911d7b46
- SSDEEP
  
  48:im14sjq8W2MPUptuMMFvx/om/ycNSCwVGfOY0vB6/JvR0Jpof5d2D:F1EBl91Z7/ycNSCwV8TLZR0Wd2
Score

3^/10
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  3f176d1ee13b0d7d6bd92e1c7a0b9bae
- SHA1
  
  fe582246792774c2c9dd15639ffa0aca90d6fd0b
- SHA256
  
  fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
- SHA512
  
  0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
- SSDEEP
  
  192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
Score

3^/10
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  b3070cf20db659fdfb3cb2ed38130e8d
- SHA1
  
  aa234b0620bebddde1414ff6b0840d883890b413
- SHA256
  
  f2c1409faf2952c1c91f4b5495158ef5c7d1a1db6eea4a18f163574bd52fcad0
- SHA512
  
  4849a4cf24ea8a26cd04eb132d479cc093d4e204ed3866a77646d03778f4c128e20722a0c3cd62ea98a37deea4ce505fe632420158c71a10b0c8c5e32b38e3f1
- SSDEEP
  
  96:oEqZ4zC5RH3cXX1LlYlRowycxM2DjDf3GEst+Nt+jvDYx40qndYHnxss:oEq+CP3uKrpyREs06YxEdGn
Score

3^/10
behavioral15 behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Modifies firewall policy service

Sets file execution options in registry

Checks BIOS information in registry

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16