chinese_generic_botnet | fc35c92c7990c972e2e54428788ae4e60eed5e27d09074429349e76784bd7dfc | Triage

Submit
Reports

Overview

overview

Static

static

3

fc35c92c79...fc.exe

windows7-x64

fc35c92c79...fc.exe

windows10-2004-x64

Sharing

General

Target

fc35c92c7990c972e2e54428788ae4e60eed5e27d09074429349e76784bd7dfc
Size

5.8MB
Sample

230529-n26dpacb5s
MD5

2776724a45ac3cb2b8f86dd29a40374e
SHA1

8c199252cc0c6e4123cb9b506685da98ddb1a212
SHA256

fc35c92c7990c972e2e54428788ae4e60eed5e27d09074429349e76784bd7dfc
SHA512

48ee3572affd1cc2a70d756a3b1afe9a9608cec1654b88c9c0b10e9acb5bd66dad38630dd085e4ae529ece12681d6063ebed86740ca948685aab66b46a248aab
SSDEEP

98304:egEI4LQQ/QUm4XHb8vFtYkQYrSz9rAmLJHORm6UJamI3LeojzZARZpkAdcc6IjWF:LqPjX7oD5rSpru+W3KMZkvdagNXhJs0I

Score

10^/10

chinese_generic_botnet botnet persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

fc35c92c7990c972e2e54428788ae4e60eed5e27d09074429349e76784bd7dfc.exe

Resource

win7-20230220-en

chinese_generic_botnet botnet

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

fc35c92c7990c972e2e54428788ae4e60eed5e27d09074429349e76784bd7dfc.exe

Resource

win10v2004-20230220-en

chinese_generic_botnet botnet persistence

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  fc35c92c7990c972e2e54428788ae4e60eed5e27d09074429349e76784bd7dfc
- Size
  
  5.8MB
- MD5
  
  2776724a45ac3cb2b8f86dd29a40374e
- SHA1
  
  8c199252cc0c6e4123cb9b506685da98ddb1a212
- SHA256
  
  fc35c92c7990c972e2e54428788ae4e60eed5e27d09074429349e76784bd7dfc
- SHA512
  
  48ee3572affd1cc2a70d756a3b1afe9a9608cec1654b88c9c0b10e9acb5bd66dad38630dd085e4ae529ece12681d6063ebed86740ca948685aab66b46a248aab
- SSDEEP
  
  98304:egEI4LQQ/QUm4XHb8vFtYkQYrSz9rAmLJHORm6UJamI3LeojzZARZpkAdcc6IjWF:LqPjX7oD5rSpru+W3KMZkvdagNXhJs0I
Score

10^/10

chinese_generic_botnet botnet persistence
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

chinese_generic_botnetbotnet

behavioral2

chinese_generic_botnetbotnetpersistence

© 2018-2025

Terms | Privacy