chinese_generic_botnet | 8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e | Triage

Submit
Reports

Overview

overview

Static

static

8

8ab2398b59...5e.exe

windows7-x64

8

8ab2398b59...5e.exe

windows10-2004-x64

Sharing

General

Target

8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e
Size

3.0MB
Sample

221026-1s14tshcc4
MD5

9301f1da68cccfa053da550107f0365c
SHA1

39a92e81e6669611b8e494c3ca2853283316d801
SHA256

8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e
SHA512

1206145a834315b385b19d3cf58abc8d7b6cc46b9315db26e671ab598faf6eb3fa0aa5a932005f8f2f16832a84dfa9bf9593a907a256b6d9155a944753b5d494
SSDEEP

49152:c2lp5nsO1lERGmC7vK9y+QXMR1UEhLdPMRG4OU09Q1IFOUCGExQPr/E+Vm5tPXXq:/p9vjHp+QAUyGG4oQ1Ib1Yxt/Xq

Score

10^/10

chinese_generic_botnet botnet persistence vmprotect

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe

Resource

win7-20220901-en

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral2

Sample

8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e.exe

Resource

win10v2004-20220812-en

chinese_generic_botnet botnet persistence vmprotect

windows10-2004-x64

15 signatures

150 seconds

Malware Config

Targets

- Target
  
  8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e
- Size
  
  3.0MB
- MD5
  
  9301f1da68cccfa053da550107f0365c
- SHA1
  
  39a92e81e6669611b8e494c3ca2853283316d801
- SHA256
  
  8ab2398b595a004529e9a2b90e7f2b3b27df587eaa4610c5447be4ce5b7f505e
- SHA512
  
  1206145a834315b385b19d3cf58abc8d7b6cc46b9315db26e671ab598faf6eb3fa0aa5a932005f8f2f16832a84dfa9bf9593a907a256b6d9155a944753b5d494
- SSDEEP
  
  49152:c2lp5nsO1lERGmC7vK9y+QXMR1UEhLdPMRG4OU09Q1IFOUCGExQPr/E+Vm5tPXXq:/p9vjHp+QAUyGG4oQ1Ib1Yxt/Xq
Score

10^/10

vmprotect chinese_generic_botnet botnet persistence
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Executes dropped EXE
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

chinese_generic_botnetbotnetpersistencevmprotect

© 2018-2025

Terms | Privacy