chinese_generic_botnet | cdc95392f7aaf04457256258571c08966e093503028339eeeb586a3d1d2903e0 | Triage

Submit
Reports

Overview

overview

Static

static

1

dridex

windows10-2004-x64

Sharing

General

Target

cdc95392f7aaf04457256258571c08966e093503028339eeeb586a3d1d2903e0
Size

1.5MB
Sample

230208-n5gvhaaf54
MD5

721740f1413193e8cbc2bc5072beada7
SHA1

943cad4421ddd671c65231dd01f34c5590afd5d2
SHA256

cdc95392f7aaf04457256258571c08966e093503028339eeeb586a3d1d2903e0
SHA512

4682774873438a2ac9bb05629a6d3124abcd93741381d053cbfdf64266c6cd74c0c58d7f3122040a1c3a0f09d12bbd98dbe2beb90b14e177b245cb02ec26f5cc
SSDEEP

24576:7JHa6PX0VhuxwQR+6CKOmi6qZsokbbbFXj+4Xnrsjp9gawa0Stirk2BK5IoW6g1S:9JkVh76CbmdqxIbbdC4XrsjpBwaFmnJM

Score

10^/10

chinese_generic_botnet botnet persistence

Static task

static1

Behavioral task

behavioral1

Sample

cdc95392f7aaf04457256258571c08966e093503028339eeeb586a3d1d2903e0.exe

Resource

win10v2004-20221111-en

chinese_generic_botnet botnet persistence

windows10-2004-x64

17 signatures

150 seconds

Malware Config

Targets

- Target
  
  cdc95392f7aaf04457256258571c08966e093503028339eeeb586a3d1d2903e0
- Size
  
  1.5MB
- MD5
  
  721740f1413193e8cbc2bc5072beada7
- SHA1
  
  943cad4421ddd671c65231dd01f34c5590afd5d2
- SHA256
  
  cdc95392f7aaf04457256258571c08966e093503028339eeeb586a3d1d2903e0
- SHA512
  
  4682774873438a2ac9bb05629a6d3124abcd93741381d053cbfdf64266c6cd74c0c58d7f3122040a1c3a0f09d12bbd98dbe2beb90b14e177b245cb02ec26f5cc
- SSDEEP
  
  24576:7JHa6PX0VhuxwQR+6CKOmi6qZsokbbbFXj+4Xnrsjp9gawa0Stirk2BK5IoW6g1S:9JkVh76CbmdqxIbbdC4XrsjpBwaFmnJM
Score

10^/10

chinese_generic_botnet botnet persistence
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

chinese_generic_botnetbotnetpersistence

© 2018-2025

Terms | Privacy