Home Malware Programs Trojans Trojan.Betabot

Trojan.Betabot

Posted: February 27, 2013

Threat Metric

Threat Level: 8/10
Infected PCs: 117
First Seen: February 27, 2013
Last Seen: March 16, 2024
OS(es) Affected: Windows

Trojan.Betabot is a Trojan that opens a back door on the infected computer. When executed, Trojan.Betabot copies itself to the specific location on the corrupted PC. Trojan.Betabot creates the registry entries that allow it to load automatically whenever Windows is started. Trojan.Betabot may also create and modify other registry entries on the targeted PC. Trojan.Betabot then modifies the registry entries to lower Internet security settings. Trojan.Betabot creates a hidden instance of the 'iexplore.exe' process and inserts a code into it. Trojan.Betabot then connects to one of the locations and opens a back door, which allows a remote attacker to obtain access and control to the victimized computer system. Trojan.Betabot then stops all programs with open windows that include 'explorer.exe'.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



file.exe File name: file.exe
Size: 1.09 MB (1092608 bytes)
MD5: f5a1184792b4ae7a32b32df2f78f856f
Detection count: 40
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%ProgramFiles%\Common Files\[TROJAN FOLDER NAME].{2227A280-3AEA-1069-A2DE-08002B30309D}\[NINE RANDOM LOWER CASE CHARACTERS].exe File name: %ProgramFiles%\Common Files\[TROJAN FOLDER NAME].{2227A280-3AEA-1069-A2DE-08002B30309D}\[NINE RANDOM LOWER CASE CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%ProgramFiles%\Common Files\[Flash Update Client].{2227A280-3AEA-1069-A2DE-08002B30309D}\[NINE RANDOM LOWER CASE CHARACTERS].exe File name: %ProgramFiles%\Common Files\[Flash Update Client].{2227A280-3AEA-1069-A2DE-08002B30309D}\[NINE RANDOM LOWER CASE CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file
%ProgramFiles%\Common Files\[Windows Licence Check].{2227A280-3AEA-1069-A2DE-08002B30309D}\[NINE RANDOM LOWER CASE CHARACTERS].exe File name: %ProgramFiles%\Common Files\[Windows Licence Check].{2227A280-3AEA-1069-A2DE-08002B30309D}\[NINE RANDOM LOWER CASE CHARACTERS].exe
File type: Executable File
Mime Type: unknown/exe
Group: Malware file

More files

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\{Value}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[TROJAN FILE NAME]\"DisableExceptionChainValidation" = ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\[TROJAN FILE NAME]\"Time" = ""HKEY_ALL_USERS\.default\Software\Microsoft\Windows NT\CurrentVersion\TaskManager\"Task Service ID" = "[RANDOM HEXADECIMAL CHARACTERS]"HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\TaskManager\"Task Service ID" = "[RANDOM HEXADECIMAL CHARACTERS]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TaskManager\"Task Service ID" = "[RANDOM HEXADECIMAL CHARACTERS]"HKEY_ALL_USERS\.default\Software\Win7zip\"Uuid" = "[RANDOM HEXADECIMAL CHARACTERS]"HKEY_ALL_USERS\.default\Software\Classes\CLSID\[RANDOM GUID]\[EIGHT HEXADECIMAL CHARACTERS]\CW1\"[THREE OR FOUR DIGITS]" = "[HEXADECIMAL CHARACTERS]"HKEY_CURRENT_USER\Software\Win7zip\"Uuid" = "[RANDOM HEXADECIMAL CHARACTERS]"HKEY_LOCAL_MACHINE\SOFTWARE\Win7zip\"Uuid" = "[RANDOM HEXADECIMAL CHARACTERS]"HKEY_ALL_USERS\.default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"2500" = "3"HKEY_ALL_USERS\.default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\"2500" = "3"HKEY_ALL_USERS\.default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\"2500" = "3"HKEY_ALL_USERS\.default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\"2500" = "3"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\"2500" = "3"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\"2500" = "3"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\"2500" = "3"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\"2500" = "3"HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Update\Policy\"EnableJavaUpdate" = "0"HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\SSDPSRV\"Start" = "2" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\"ShowSuperHidden" = "0"HKEY..\..\..\..{Subkeys}HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[TROJAN FOLDER NAME]" = "[PATH TO TROJAN EXECUTABLE]"HKEY_ALL_USERS\.default\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\"[TROJAN FOLDER NAME]" = "[PATH TO TROJAN EXECUTABLE]"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"[TROJAN FOLDER NAME]" = "[PATH TO TROJAN EXECUTABLE]"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\"[TROJAN FOLDER NAME]" = "[PATH TO TROJAN EXECUTABLE]"HKEY_ALL_USERS\.default\Software\Microsoft\Windows\CurrentVersion\Run\"[TROJAN FOLDER NAME]" = "[PATH TO TROJAN EXECUTABLE]"

Additional Information

The following directories were created:
%ALLUSERSPROFILE%\Desktop Management Agent
Loading...