betabot | aaef9bebdcd49a4d0191a751bb18d2ae1e182851cf5f6c4c5cea70aba8de86f8 | Triage

Submit
Reports

Overview

overview

Static

static

3

2dd74e8823...18.exe

windows7-x64

2dd74e8823...18.exe

windows10-2004-x64

Sharing

General

Target

2dd74e8823191aa09223f463c1ed6c42_JaffaCakes118
Size

341KB
Sample

240329-1wed8sbf52
MD5

2dd74e8823191aa09223f463c1ed6c42
SHA1

48e6a01df30dc9b747118020ebba0ca033ed706e
SHA256

aaef9bebdcd49a4d0191a751bb18d2ae1e182851cf5f6c4c5cea70aba8de86f8
SHA512

7934007f62682d076e6a66b01bf9cc90c4c6b8c098fb51f5ae9e8820f577c76bcb05917b4bc0d3822d103e24eaf544ae6c8d878fe7ef3701b32b83a261b7db63
SSDEEP

6144:YsYC13QdnprC6ft8F/lP5FAphjwIj6bV9iLUyfrJdpMo:YDCRQdnU618YsIjAWUyTJMo

Score

10^/10

betabot backdoor botnet evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

2dd74e8823191aa09223f463c1ed6c42_JaffaCakes118.exe

Resource

win7-20240221-en

betabot backdoor botnet evasion persistence trojan

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

2dd74e8823191aa09223f463c1ed6c42_JaffaCakes118.exe

Resource

win10v2004-20240319-en

betabot backdoor botnet evasion persistence trojan

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  2dd74e8823191aa09223f463c1ed6c42_JaffaCakes118
- Size
  
  341KB
- MD5
  
  2dd74e8823191aa09223f463c1ed6c42
- SHA1
  
  48e6a01df30dc9b747118020ebba0ca033ed706e
- SHA256
  
  aaef9bebdcd49a4d0191a751bb18d2ae1e182851cf5f6c4c5cea70aba8de86f8
- SHA512
  
  7934007f62682d076e6a66b01bf9cc90c4c6b8c098fb51f5ae9e8820f577c76bcb05917b4bc0d3822d103e24eaf544ae6c8d878fe7ef3701b32b83a261b7db63
- SSDEEP
  
  6144:YsYC13QdnprC6ft8F/lP5FAphjwIj6bV9iLUyfrJdpMo:YDCRQdnU618YsIjAWUyTJMo
Score

10^/10

betabot backdoor botnet evasion persistence trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Modifies firewall policy service
  evasion
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

betabotbackdoorbotnetevasionpersistencetrojan

behavioral2

betabotbackdoorbotnetevasionpersistencetrojan

© 2018-2024

Terms | Privacy