chinese_generic_botnet | e2de578cc207a0866c80c889c53aa94358a7bb07418b9731c3f94a564eb7d914 | Triage

Submit
Reports

Overview

overview

Static

static

8

e2de578cc2...14.exe

windows7-x64

8

e2de578cc2...14.exe

windows10-2004-x64

Sharing

General

Target

e2de578cc207a0866c80c889c53aa94358a7bb07418b9731c3f94a564eb7d914
Size

754KB
Sample

221123-ydt1vshg84
MD5

b75f4b6f92fde130c694f264d4c8d403
SHA1

c0dd0dbcf20f3e85a7a00c4376b624f90ded9361
SHA256

e2de578cc207a0866c80c889c53aa94358a7bb07418b9731c3f94a564eb7d914
SHA512

d4711f7dcfecd1cfd67a4a35c7ab6b7a6fe19d921257d0722f25f535dd7693164ab33db9d9693b3c4ab7e747d6c2dad95f61fe702ab669e170968743d3c94ef2
SSDEEP

12288:iplHTKI+LJ6knFQ8LckSl4PDVMfpoLqLWvItSesv6+G:YBaJ6G/LckSl4PDKf3LCW86+G

Score

10^/10

chinese_generic_botnet botnet persistence upx vmprotect

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e2de578cc207a0866c80c889c53aa94358a7bb07418b9731c3f94a564eb7d914.exe

Resource

win7-20221111-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

e2de578cc207a0866c80c889c53aa94358a7bb07418b9731c3f94a564eb7d914.exe

Resource

win10v2004-20220812-en

chinese_generic_botnet botnet persistence upx vmprotect

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  e2de578cc207a0866c80c889c53aa94358a7bb07418b9731c3f94a564eb7d914
- Size
  
  754KB
- MD5
  
  b75f4b6f92fde130c694f264d4c8d403
- SHA1
  
  c0dd0dbcf20f3e85a7a00c4376b624f90ded9361
- SHA256
  
  e2de578cc207a0866c80c889c53aa94358a7bb07418b9731c3f94a564eb7d914
- SHA512
  
  d4711f7dcfecd1cfd67a4a35c7ab6b7a6fe19d921257d0722f25f535dd7693164ab33db9d9693b3c4ab7e747d6c2dad95f61fe702ab669e170968743d3c94ef2
- SSDEEP
  
  12288:iplHTKI+LJ6knFQ8LckSl4PDVMfpoLqLWvItSesv6+G:YBaJ6G/LckSl4PDKf3LCW86+G
Score

10^/10

upx chinese_generic_botnet botnet persistence vmprotect
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Downloads MZ/PE file
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
- Deletes itself
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

chinese_generic_botnetbotnetpersistenceupxvmprotect

© 2018-2025

Terms | Privacy