Overview

overview

10

Static

static

诈骗团�...at.exe

windows7_x64

10

诈骗团�...at.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    诈骗团伙在暗网倒卖5000余万条个人信息曝光.bat

  • Size

    1.8MB

  • Sample

    210922-zwnggadhd6

  • MD5

    dd5ad0f08229b6b8a5624bd03ba907c7

  • SHA1

    b406b4ea867d258f7ec0b31d89cbfe4abd16352f

  • SHA256

    2eecb7f3ac6d026ebaed050b0fa0657a6a31a3147ac2f70e61022d729fbbbad3

  • SHA512

    51f578395ad0caeb3906c63c1418cefdbff5c5efce56a7e0e20627db478cb9c2c7cf31da277e53f6ea250a38fea9b2ef29a6b1091e55b91f44cd9dce349e2418

Score
10/10
chinese_generic_botnetbotnetpersistence

Malware Config

Targets

    • Target

      诈骗团伙在暗网倒卖5000余万条个人信息曝光.bat

    • Size

      1.8MB

    • MD5

      dd5ad0f08229b6b8a5624bd03ba907c7

    • SHA1

      b406b4ea867d258f7ec0b31d89cbfe4abd16352f

    • SHA256

      2eecb7f3ac6d026ebaed050b0fa0657a6a31a3147ac2f70e61022d729fbbbad3

    • SHA512

      51f578395ad0caeb3906c63c1418cefdbff5c5efce56a7e0e20627db478cb9c2c7cf31da277e53f6ea250a38fea9b2ef29a6b1091e55b91f44cd9dce349e2418

    Score
    10/10
    chinese_generic_botnetbotnetpersistence

    • Generic Chinese Botnet

      A botnet originating from China which is currently unnamed publicly.

      botnetchinese_generic_botnet

    • Chinese Botnet Payload

      botnet

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks