betabot | 9eddb5fc86d355f6c10e5e450f3fde24ff070e4e93fe9218f10dc660b36c46d0 | Triage

Submit
Reports

Overview

overview

Static

static

3

3842232d06...18.exe

windows7-x64

3842232d06...18.exe

windows10-2004-x64

Sharing

General

Target

3842232d06e9bbad23c68e9befa445ae_JaffaCakes118
Size

598KB
Sample

240512-e32bpage9v
MD5

3842232d06e9bbad23c68e9befa445ae
SHA1

6283bd8489cf75dedc3d1489ccf93b5acc0c3492
SHA256

9eddb5fc86d355f6c10e5e450f3fde24ff070e4e93fe9218f10dc660b36c46d0
SHA512

11f9114dce081e2efea4cccbdfee21aa6ee4abab2acf7ae492b0448ca715b719334ad6a83570fde9caf4fd94fcbd767b94aba12054fdc7d1e2a73d1d96ee27c2
SSDEEP

6144:9ZDusLVUUnjDNfESZeGY9XsBFy56fgmVj1otMcUEwphR/35SI4AZgAwsT:94s5Uk5HZeMDHj1wM8UDN4qgbe

Score

10^/10

betabot backdoor botnet evasion persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

3842232d06e9bbad23c68e9befa445ae_JaffaCakes118.exe

Resource

win7-20240508-en

betabot backdoor botnet evasion persistence trojan

windows7-x64

18 signatures

150 seconds

Behavioral task

behavioral2

Sample

3842232d06e9bbad23c68e9befa445ae_JaffaCakes118.exe

Resource

win10v2004-20240426-en

betabot backdoor botnet evasion persistence trojan

windows10-2004-x64

19 signatures

150 seconds

Malware Config

Targets

- Target
  
  3842232d06e9bbad23c68e9befa445ae_JaffaCakes118
- Size
  
  598KB
- MD5
  
  3842232d06e9bbad23c68e9befa445ae
- SHA1
  
  6283bd8489cf75dedc3d1489ccf93b5acc0c3492
- SHA256
  
  9eddb5fc86d355f6c10e5e450f3fde24ff070e4e93fe9218f10dc660b36c46d0
- SHA512
  
  11f9114dce081e2efea4cccbdfee21aa6ee4abab2acf7ae492b0448ca715b719334ad6a83570fde9caf4fd94fcbd767b94aba12054fdc7d1e2a73d1d96ee27c2
- SSDEEP
  
  6144:9ZDusLVUUnjDNfESZeGY9XsBFy56fgmVj1otMcUEwphR/35SI4AZgAwsT:94s5Uk5HZeMDHj1wM8UDN4qgbe
Score

10^/10

betabot backdoor botnet evasion persistence trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Modifies firewall policy service
  evasion
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

betabotbackdoorbotnetevasionpersistencetrojan

behavioral2

betabotbackdoorbotnetevasionpersistencetrojan

© 2018-2024

Terms | Privacy