Trojan

About “Trojan.Win32.Betabot.k” infection

Malware Removal

The Trojan.Win32.Betabot.k is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Win32.Betabot.k virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • A process created a hidden window
  • CAPE extracted potentially suspicious content
  • The binary contains an unknown PE section name indicative of packing
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid

How to determine Trojan.Win32.Betabot.k?


File Info:

name: 4683F5DE8A2C402A489B.mlw
path: /opt/CAPEv2/storage/binaries/017016a0d2b07a65d15d33c7d03c7bd8c2293b75ef56a2f8a747021ed162abe0
crc32: D3C30A96
md5: 4683f5de8a2c402a489b3d638cb2fcd5
sha1: 200e977cb8be370a2c78923d46cecc1fbaca5998
sha256: 017016a0d2b07a65d15d33c7d03c7bd8c2293b75ef56a2f8a747021ed162abe0
sha512: a87efa8746edb0816855f86feebf3a98b7e19e1ca370c29cc4f9bbaa33b01baa14d757bad5d870bb219cdaf5dd444abaf693c53eebff38e8b40935ab9b1b5e72
ssdeep: 49152:LtpjhD6pttlbABJdpnfc4XFNldkTMutuXpvYMMpb84yfw0QT13GKkxHkKnfc4XFI:v1olbUpXY3yw0QT13WX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11716CF163395C416D1BE0274887287AD03B1FE279B26DB8F29C934AE5DB1781DF22367
sha3_384: 827fa0002c1694cb373f3b2799f6b74ae28ed359599c802287b2c6fa72bfba69b849eaf70ac08165b394976d9385be30
ep_bytes: ff250020400000000000000000000000
timestamp: 2010-11-12 16:32:38

Version Info:

Translation: 0x0000 0x04b0
Comments: LabTech Silent Installer.
CompanyName: LabTech Software, LLC.
FileDescription: LTSilent
FileVersion: 31.1.3944.17813
InternalName: LTSilent.exe
LegalCopyright: Copyright© 2005-2010 LabTech Software, LLC
OriginalFilename: LTSilent.exe
ProductName: LabTech MSP
ProductVersion: 3.0
Assembly Version: 31.1.3944.17813

Trojan.Win32.Betabot.k also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.GenericKD.47472719
FireEyeGeneric.mg.4683f5de8a2c402a
McAfeeArtemis!4683F5DE8A2C
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
K7AntiVirusTrojan ( 700000121 )
AlibabaTrojan:Win32/Betabot.1924cc79
K7GWTrojan ( 700000121 )
CrowdStrikewin/malicious_confidence_60% (D)
CyrenW32/A-9050270e!Eldorado
SymantecML.Attribute.HighConfidence
APEXMalicious
Paloaltogeneric.ml
KasperskyTrojan.Win32.Betabot.k
BitDefenderTrojan.GenericKD.47472719
NANO-AntivirusTrojan.Win32.RiskGen.dchwot
AvastWin32:Malware-gen
TencentMalware.Win32.Gencirc.1149766a
Ad-AwareTrojan.GenericKD.47472719
SophosMal/Generic-S
DrWebTrojan.PWS.Siggen1.27424
ZillyaTrojan.Betabot.Win32.9
TrendMicroTROJ_GEN.R002C0WKP21
McAfee-GW-EditionArtemis!Trojan
EmsisoftTrojan.GenericKD.47472719 (B)
SentinelOneStatic AI – Malicious PE
GDataMSIL.Trojan.BSE.1RBQ0XA
JiangminTrojan.Betabot.g
AviraHEUR/AGEN.1108896
MAXmalware (ai score=89)
MicrosoftTrojan:Win32/Wacatac.B!ml
CynetMalicious (score: 99)
ALYacTrojan.GenericKD.47472719
VBA32Trojan.Betabot
MalwarebytesMalware.AI.3709619103
TrendMicro-HouseCallTROJ_GEN.R002C0WKP21
YandexRiskware.RemoteAdmin!sY+0qOUYQbU
IkarusTrojan.Rogue.11181390
eGambitnot-a-virus:remoteAdmin.VNC.Variant
FortinetMSIL/Generic.AP.BFC6E2!tr
AVGWin32:Malware-gen
Cybereasonmalicious.cb8be3
MaxSecureTrojan.Malware.300983.susgen

How to remove Trojan.Win32.Betabot.k?

Trojan.Win32.Betabot.k removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment