betabot | 928d06ae692be5a216946aa53308e34b920cdd65eb1eb1f7aad9d4edf779c8b6 | Triage

Sharing

General

Target

a41a425b9aa3dcb50ea244ff90cef59d_JaffaCakes118
Size

331KB
Sample

240613-gq7zta1anl
MD5

a41a425b9aa3dcb50ea244ff90cef59d
SHA1

2d1c8cfba8e5ef11a2a5144346f8102c3c9db805
SHA256

928d06ae692be5a216946aa53308e34b920cdd65eb1eb1f7aad9d4edf779c8b6
SHA512

6b82375eb4645cc8e615c4699fb4eeada8b4a0f50b89bd512810c9c1d643977ae1e5472ee2ea2d8cfb69133381120267db5cd863a10746843bed79e0d5a88334
SSDEEP

6144:R6tnHIghzbAam9iliAotWWfUwwQWzyq2L9OATfzSskQBi:+HrhzW3Jq49zfGQBi

Score

10^/10

betabot backdoor botnet evasion persistence trojan

Malware Config

Targets

- Target
  
  a41a425b9aa3dcb50ea244ff90cef59d_JaffaCakes118
- Size
  
  331KB
- MD5
  
  a41a425b9aa3dcb50ea244ff90cef59d
- SHA1
  
  2d1c8cfba8e5ef11a2a5144346f8102c3c9db805
- SHA256
  
  928d06ae692be5a216946aa53308e34b920cdd65eb1eb1f7aad9d4edf779c8b6
- SHA512
  
  6b82375eb4645cc8e615c4699fb4eeada8b4a0f50b89bd512810c9c1d643977ae1e5472ee2ea2d8cfb69133381120267db5cd863a10746843bed79e0d5a88334
- SSDEEP
  
  6144:R6tnHIghzbAam9iliAotWWfUwwQWzyq2L9OATfzSskQBi:+HrhzW3Jq49zfGQBi
Score

10^/10

betabot backdoor botnet evasion persistence trojan
- BetaBot
  Beta Bot is a Trojan that infects computers and disables Antivirus.
  trojan backdoor botnet betabot
- Modifies firewall policy service
  evasion
- Sets file execution options in registry
  persistence
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Subvert Trust Controls

Install Root Certificate

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

betabotbackdoorbotnetevasionpersistencetrojan

behavioral2

betabotbackdoorbotnetevasionpersistencetrojan