betabot | c931a86f11c0462b350943c7719a8c1484a8855c6afe06c2562f6bc25cc73456 | Triage

Submit
Reports

Overview

overview

Static

static

3

0d12a528e4...18.exe

windows7-x64

0d12a528e4...18.exe

windows10-2004-x64

3

Sharing

General

Target

0d12a528e41c9bd514307170f65dd49d_JaffaCakes118
Size

646KB
Sample

240502-bkq68aeg75
MD5

0d12a528e41c9bd514307170f65dd49d
SHA1

a6105559a61be183e0b4902669c775c1cb147b22
SHA256

c931a86f11c0462b350943c7719a8c1484a8855c6afe06c2562f6bc25cc73456
SHA512

7832a063e7ae5cafe637457d14cd33ee92e7de4975bfaf5d93920e8600de9530978fe7fb43eb2770d2667d8ef562f0e2b44bc076eff75486de8a83a03dd0dfe2
SSDEEP

12288:fs4y9lkO5EiXEuA4bFnq+oCn/PY9W9k3nlWW:E1d2iX9vFxN/QN

Score

10^/10

betabot backdoor botnet evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

0d12a528e41c9bd514307170f65dd49d_JaffaCakes118.exe

Resource

win7-20240215-en

betabot backdoor botnet evasion persistence trojan

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

0d12a528e41c9bd514307170f65dd49d_JaffaCakes118.exe

Resource

win10v2004-20240419-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  0d12a528e41c9bd514307170f65dd49d_JaffaCakes118
- Size
  
  646KB
- MD5
  
  0d12a528e41c9bd514307170f65dd49d
- SHA1
  
  a6105559a61be183e0b4902669c775c1cb147b22
- SHA256
  
  c931a86f11c0462b350943c7719a8c1484a8855c6afe06c2562f6bc25cc73456
- SHA512
  
  7832a063e7ae5cafe637457d14cd33ee92e7de4975bfaf5d93920e8600de9530978fe7fb43eb2770d2667d8ef562f0e2b44bc076eff75486de8a83a03dd0dfe2
- SSDEEP
  
  12288:fs4y9lkO5EiXEuA4bFnq+oCn/PY9W9k3nlWW:E1d2iX9vFxN/QN
Score

10^/10

betabot backdoor botnet evasion persistence trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Modifies firewall policy service
  evasion
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

betabotbackdoorbotnetevasionpersistencetrojan

behavioral2

© 2018-2025

Terms | Privacy