chinese_generic_botnet | 149da12f4493232f304823a53346c7d88d3a1e3d6229834ea2218f849d1d1949 | Triage

Submit
Reports

Overview

overview

Static

static

1

tmp.exe

windows7-x64

tmp.exe

windows10-2004-x64

3

Sharing

General

Target

tmp
Size

865KB
Sample

230325-remvlsfb3x
MD5

bf2f107bd78e2a8888f9b72bb0f53e14
SHA1

ac080f8c59943629e414a30455085ff283490b26
SHA256

149da12f4493232f304823a53346c7d88d3a1e3d6229834ea2218f849d1d1949
SHA512

007fc733a819a250f05b50717437e8fe74c6d759b330df1367938e946e8d6adb7c0aa8d2b0f15aa04deef4210a2afe0ce84137c18880bf3d95aa14739e8f17f9
SSDEEP

24576:xCOI2pwMzk68ysHPot72W6u99z6Zlu/Kz0xaYVC3U6m+Y7w0XDwD6k0:UOzz6yugt6ZuTz6Zlf08P3U6mRM4DC6f

Score

10^/10

chinese_generic_botnet botnet persistence

Static task

static1

Behavioral task

behavioral1

Sample

tmp.exe

Resource

win7-20230220-en

chinese_generic_botnet botnet persistence

windows7-x64

21 signatures

150 seconds

Behavioral task

behavioral2

Sample

tmp.exe

Resource

win10v2004-20230220-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  tmp
- Size
  
  865KB
- MD5
  
  bf2f107bd78e2a8888f9b72bb0f53e14
- SHA1
  
  ac080f8c59943629e414a30455085ff283490b26
- SHA256
  
  149da12f4493232f304823a53346c7d88d3a1e3d6229834ea2218f849d1d1949
- SHA512
  
  007fc733a819a250f05b50717437e8fe74c6d759b330df1367938e946e8d6adb7c0aa8d2b0f15aa04deef4210a2afe0ce84137c18880bf3d95aa14739e8f17f9
- SSDEEP
  
  24576:xCOI2pwMzk68ysHPot72W6u99z6Zlu/Kz0xaYVC3U6m+Y7w0XDwD6k0:UOzz6yugt6ZuTz6Zlf08P3U6mRM4DC6f
Score

10^/10

chinese_generic_botnet botnet persistence
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

chinese_generic_botnetbotnetpersistence

behavioral2

© 2018-2025

Terms | Privacy