betabot | 06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645 | Triage

Submit
Reports

Overview

overview

Static

static

3

cf4e015eea...97.exe

windows7-x64

cf4e015eea...97.exe

windows10-2004-x64

Sharing

General

Target

cf4e015eeabfd226f997a8aa258c3d97
Size

957KB
Sample

240316-2228xsee8v
MD5

cf4e015eeabfd226f997a8aa258c3d97
SHA1

eb2c8d789ab2e2b4c12dff88f7553114ada1f054
SHA256

06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645
SHA512

01283868f2887fcf2527d3cbaf2db860e010d1a77c6af7b409a7ebfc677cf3437c86b2dfeeda02ed316ef723cf3c0a3457aa977e1f3eea2f9d8f834f07dd8317
SSDEEP

24576:ypfCvc5/gdZWrtMEgXDHXnTy7ovzR9JzTooO8vx/O:yp6vc6ZW2EgTHXnTeoztGc

Score

10^/10

betabot backdoor botnet evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

cf4e015eeabfd226f997a8aa258c3d97.exe

Resource

win7-20240221-en

betabot backdoor botnet evasion persistence trojan

windows7-x64

20 signatures

150 seconds

Behavioral task

behavioral2

Sample

cf4e015eeabfd226f997a8aa258c3d97.exe

Resource

win10v2004-20231215-en

betabot backdoor botnet evasion persistence trojan

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  cf4e015eeabfd226f997a8aa258c3d97
- Size
  
  957KB
- MD5
  
  cf4e015eeabfd226f997a8aa258c3d97
- SHA1
  
  eb2c8d789ab2e2b4c12dff88f7553114ada1f054
- SHA256
  
  06104da8d17662bd405006269c9437f542e2291a8dfcc62b5a6821bcb3a9f645
- SHA512
  
  01283868f2887fcf2527d3cbaf2db860e010d1a77c6af7b409a7ebfc677cf3437c86b2dfeeda02ed316ef723cf3c0a3457aa977e1f3eea2f9d8f834f07dd8317
- SSDEEP
  
  24576:ypfCvc5/gdZWrtMEgXDHXnTy7ovzR9JzTooO8vx/O:yp6vc6ZW2EgTHXnTeoztGc
Score

10^/10

betabot backdoor botnet evasion persistence trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Modifies firewall policy service
  evasion
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

betabotbackdoorbotnetevasionpersistencetrojan

behavioral2

betabotbackdoorbotnetevasionpersistencetrojan

© 2018-2024

Terms | Privacy