chinese_generic_botnet | d1aaa7e7_00408000[.]mem

Sharing

Copy URL

Twitter E-mail

General

Target

d1aaa7e7_00408000.mem
Size

315KB
MD5

d2e6d287cfe6a8fa01b2af951dd923e2
SHA1

c45ec9cfb6fc05242bd1d1a0c8b350cba0025737
SHA256

cc6be92997ce0f59ddd2ab389ce6448e2e711babb03a36d4c9e31ed28d336c1f
SHA512

ca44efad95e34b2045d5b4ad99fc1c9e73286cb6d36a2f760e873e57b4dfcdd4500f58fd45624eda5bc194cf0d389384ce9fbd45e8e3d18ee567ea6b2599e1ad
SSDEEP

1536:V2yNWTyVrtUps8aHN+CfdyXODKGEmQu+hVQDfOJboXjcm7r1ED:V27+VxUuLxfdyXfmts5bqcWr1ED

Score

10^/10

botnet chinese_generic_botnet

Malware Config

Signatures

Chinese Botnet payload 1 IoCs

botnet

resource	yara_rule
sample	unk_chinese_botnet

Chinese_generic_botnet family
chinese_generic_botnet

Files

d1aaa7e7_00408000.mem
.dll windows x86

cb12a75c96f0425e9a861d329fcf1d08

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
lstrcpyA
lstrcatA
GetSystemDirectoryA
TerminateProcess
CreateProcessA
GetCurrentProcessId
lstrlenA
SetFilePointer
GetFileSize
GetLocalTime
ExpandEnvironmentStringsA
TerminateThread
ResumeThread
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
DeleteFileA
GetVersionExA
OutputDebugStringA
LocalAlloc
ReadFile
HeapAlloc
GetProcessHeap
GetProcAddress
HeapFree
GetSystemInfo
lstrcmpiA
LoadLibraryW
GetDiskFreeSpaceExA
GetDriveTypeA
GlobalMemoryStatusEx
WinExec
FindClose
RemoveDirectoryA
GetFileAttributesA
DuplicateHandle
OpenProcess
CreateDirectoryA
ReleaseMutex
CreateMutexA
MoveFileExA
MoveFileA
SetFileAttributesA
DefineDosDeviceA
ExitProcess
CopyFileA
GetCurrentThreadId
Process32Next
Process32First
FreeLibrary
CreateThread
ExitThread
GetTickCount
CancelIo
InterlockedExchange
SetEvent
ResetEvent
WaitForSingleObject
CreateEventA
GlobalAlloc
GetLastError
LocalFree
SetLastError
CreateFileA
DeviceIoControl
WriteFile
CloseHandle
Sleep
GetVersion
VirtualFree
GetCurrentProcess
FindFirstFileA
FindNextFileA
GlobalLock
GlobalUnlock
VirtualAlloc
VirtualProtect

user32

EnumWindows
IsWindowVisible
GetLastInputInfo
MessageBoxA
FindWindowA
GetClassNameA
GetWindow
GetKeyState
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
wsprintfA
EmptyClipboard
GetMessageA
PostThreadMessageA
GetInputState
SendMessageA
OpenClipboard
CloseClipboard
GetClipboardData
ExitWindowsEx
SetClipboardData

advapi32

OpenServiceA
CloseEventLog
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
DeleteService
OpenSCManagerA
RegCloseKey
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyA
RegQueryValueA
CreateProcessAsUserA
SetTokenInformation
DuplicateTokenEx
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CloseServiceHandle
StartServiceA
UnlockServiceDatabase
ChangeServiceConfig2A
LockServiceDatabase
CreateServiceA
ClearEventLogA

shell32

ShellExecuteExA
SHGetSpecialFolderPathA
ShellExecuteA
SHChangeNotify

ole32

CoUninitialize
CoCreateGuid
CoInitialize

ws2_32

closesocket
WSAGetLastError
gethostname
WSAStartup
WSACleanup
WSAIoctl
setsockopt
connect
htons
gethostbyname
socket
recv
select
getsockname
send
inet_addr
sendto
htonl
WSASocketA
inet_ntoa

msvcrt

_strupr
strlen
_strcmpi
_onexit
__dllonexit
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
fopen
fprintf
fclose
_beginthreadex
_except_handler3
strncmp
_snprintf
_access
_mbscmp
_mbsicmp
strrchr
free
realloc
strcmp
malloc
time
srand
strchr
sprintf
strstr
strcspn
strncpy
atoi
rand
_CxxThrowException
memcmp
??2@YAPAXI@Z
memset
exit
strcpy
strcat
_stricmp
__CxxFrameHandler
_ftol
memcpy
??3@YAXPAX@Z

mfc42

ord540
ord941
ord940
ord800
ord860

setupapi

SetupDiEnumDeviceInfo
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsA
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA

iphlpapi

GetIfTable

urlmon

URLDownloadToFileA

Exports

Exports

fuckyou
fuckyou1

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cb12a75c96f0425e9a861d329fcf1d08

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

ws2_32

msvcrt

mfc42

setupapi

iphlpapi

urlmon

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 40KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 12KB - Virtual size: 13KB

.reloc Size: 8KB - Virtual size: 4KB

.text
Size: 44KB - Virtual size: 40KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 12KB - Virtual size: 13KB

.reloc
Size: 8KB - Virtual size: 4KB