Overview

overview

10

Static

static

exploror.exe

windows7_x64

10

exploror.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    exploror.exe

  • Size

    1.1MB

  • Sample

    220522-f3sj8afga2

  • MD5

    d6df53506b123f5717463d0355336979

  • SHA1

    7720fb4b89a4ebcef32a6d6a9a7a88c65cad2c14

  • SHA256

    70969f1d56ec1ddcae3fc50545c0a351b798226c62d870db8ae5170eeec67694

  • SHA512

    1bfefa221ed77ef05fc72fbc20a322cae990b2a33a9af47b9ee4d9fa1c09d5c81f6a8fd8496ed43a47ee2862e1e2bf1651b4cca2f5e9e23e491c3d4b3249ad2f

Score
10/10
chinese_generic_botnetbotnetpersistence

Malware Config

Targets

    • Target

      exploror.exe

    • Size

      1.1MB

    • MD5

      d6df53506b123f5717463d0355336979

    • SHA1

      7720fb4b89a4ebcef32a6d6a9a7a88c65cad2c14

    • SHA256

      70969f1d56ec1ddcae3fc50545c0a351b798226c62d870db8ae5170eeec67694

    • SHA512

      1bfefa221ed77ef05fc72fbc20a322cae990b2a33a9af47b9ee4d9fa1c09d5c81f6a8fd8496ed43a47ee2862e1e2bf1651b4cca2f5e9e23e491c3d4b3249ad2f

    Score
    10/10
    chinese_generic_botnetbotnetpersistence

    • Generic Chinese Botnet

      A botnet originating from China which is currently unnamed publicly.

      botnetchinese_generic_botnet

    • Chinese Botnet Payload

      botnet

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks