chinese_generic_botnet | 7a044ca76c573b140d38e91b51a49fea69be0016d979d875030928b99ccd6d4c | Triage

Submit
Reports

Overview

overview

Static

static

7a044ca76c...4c.exe

windows7-x64

7a044ca76c...4c.exe

windows10-2004-x64

Sharing

General

Target

7a044ca76c573b140d38e91b51a49fea69be0016d979d875030928b99ccd6d4c
Size

652KB
Sample

221022-r2txfadghp
MD5

bc6cba1924615d3419b578ec0dacb52a
SHA1

e52ac072219ef95fd4594b6c882642fa1791eeb6
SHA256

7a044ca76c573b140d38e91b51a49fea69be0016d979d875030928b99ccd6d4c
SHA512

8212bf03afad0cd7c4ca1cb519baf36798d04a81dfce000b29f8e47ac4297628633fe35fbdfe9fca2cf75df77c53e5a9f57c8244761ba729990a4d6acb9a2483
SSDEEP

12288:PIgegV1Ye7I9Kjj7D+pbAqmNlV2NCM3vHoFN6WtljaElI5w:Po41YKIGnqmNlkvHoFN6WtljaEy5w

Score

10^/10

chinese_generic_botnet aspackv2 botnet

Static task

static1

Behavioral task

behavioral1

Sample

7a044ca76c573b140d38e91b51a49fea69be0016d979d875030928b99ccd6d4c.exe

Resource

win7-20220812-en

chinese_generic_botnet aspackv2 botnet

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

7a044ca76c573b140d38e91b51a49fea69be0016d979d875030928b99ccd6d4c.exe

Resource

win10v2004-20220812-en

chinese_generic_botnet aspackv2 botnet

windows10-2004-x64

12 signatures

150 seconds

Malware Config

Targets

- Target
  
  7a044ca76c573b140d38e91b51a49fea69be0016d979d875030928b99ccd6d4c
- Size
  
  652KB
- MD5
  
  bc6cba1924615d3419b578ec0dacb52a
- SHA1
  
  e52ac072219ef95fd4594b6c882642fa1791eeb6
- SHA256
  
  7a044ca76c573b140d38e91b51a49fea69be0016d979d875030928b99ccd6d4c
- SHA512
  
  8212bf03afad0cd7c4ca1cb519baf36798d04a81dfce000b29f8e47ac4297628633fe35fbdfe9fca2cf75df77c53e5a9f57c8244761ba729990a4d6acb9a2483
- SSDEEP
  
  12288:PIgegV1Ye7I9Kjj7D+pbAqmNlV2NCM3vHoFN6WtljaElI5w:Po41YKIGnqmNlkvHoFN6WtljaEy5w
Score

10^/10

chinese_generic_botnet aspackv2 botnet
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

chinese_generic_botnetaspackv2botnet

behavioral2

chinese_generic_botnetaspackv2botnet

© 2018-2025

Terms | Privacy