chinese_generic_botnet | 0270b007e6de08e544cc33308d6fe72f3ceeb653fd9b30025ee92fe057f9d0db | Triage

Submit
Reports

Overview

overview

Static

static

8

0270b007e6...db.exe

windows7-x64

8

0270b007e6...db.exe

windows10-2004-x64

Sharing

General

Target

0270b007e6de08e544cc33308d6fe72f3ceeb653fd9b30025ee92fe057f9d0db
Size

639KB
Sample

221123-xqq93aaf9x
MD5

7dfe5c3f939f8afc1afb3df143f9c163
SHA1

6a4d73f8d3679bd5cdfc8ab83c3c79c62f52d09f
SHA256

0270b007e6de08e544cc33308d6fe72f3ceeb653fd9b30025ee92fe057f9d0db
SHA512

ed25c2616461f04975c5d989044ca564bf6b1abe7961e8ed8838ebb8610e2fa1572778f800fa1902a32535bb71ba8cdeacdf991ac66278fa74e8ffdf3d808250
SSDEEP

12288:b7147s9Tc5jXJrep2+RfrN1wMknfSvV8EDYSf4lBDDkiu:b7/AJXJreXRfringVZYLlBDDG

Score

10^/10

chinese_generic_botnet botnet persistence upx vmprotect

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

0270b007e6de08e544cc33308d6fe72f3ceeb653fd9b30025ee92fe057f9d0db.exe

Resource

win7-20221111-en

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

0270b007e6de08e544cc33308d6fe72f3ceeb653fd9b30025ee92fe057f9d0db.exe

Resource

win10v2004-20220901-en

chinese_generic_botnet botnet persistence upx vmprotect

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  0270b007e6de08e544cc33308d6fe72f3ceeb653fd9b30025ee92fe057f9d0db
- Size
  
  639KB
- MD5
  
  7dfe5c3f939f8afc1afb3df143f9c163
- SHA1
  
  6a4d73f8d3679bd5cdfc8ab83c3c79c62f52d09f
- SHA256
  
  0270b007e6de08e544cc33308d6fe72f3ceeb653fd9b30025ee92fe057f9d0db
- SHA512
  
  ed25c2616461f04975c5d989044ca564bf6b1abe7961e8ed8838ebb8610e2fa1572778f800fa1902a32535bb71ba8cdeacdf991ac66278fa74e8ffdf3d808250
- SSDEEP
  
  12288:b7147s9Tc5jXJrep2+RfrN1wMknfSvV8EDYSf4lBDDkiu:b7/AJXJreXRfringVZYLlBDDG
Score

10^/10

upx chinese_generic_botnet botnet persistence vmprotect
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

chinese_generic_botnetbotnetpersistenceupxvmprotect

© 2018-2025

Terms | Privacy