chinese_generic_botnet | bca805f28e54c951189578d379dbe94366d0e29fbc334e65786f547da4760428 | Triage

Submit
Reports

Overview

overview

Static

static

3

bca805f28e...28.exe

windows7-x64

bca805f28e...28.exe

windows10-2004-x64

3

Sharing

General

Target

bca805f28e54c951189578d379dbe94366d0e29fbc334e65786f547da4760428
Size

833KB
Sample

230810-a7ew2agf44
MD5

20c7c9a0d90fee734d3824255bf09e45
SHA1

72ff70ab0dd20cad1d36ae4b1fffb5cdfe4ad73e
SHA256

bca805f28e54c951189578d379dbe94366d0e29fbc334e65786f547da4760428
SHA512

09f43d460c452980be87136264d9d63613f6fd4d02db68a48ff5d3f8542f45215c4315239d5c6354b59620bfb38be1febdd04ad87f20af9cb9783007844850d3
SSDEEP

24576:OkXRu60c+p0/B3jOjp9AcGpwJaS5mgLclZIOJQ7C8:DXR770sMjbAcOw6gw/9c

Score

10^/10

chinese_generic_botnet botnet persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

bca805f28e54c951189578d379dbe94366d0e29fbc334e65786f547da4760428.exe

Resource

win7-20230712-en

chinese_generic_botnet botnet persistence

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

bca805f28e54c951189578d379dbe94366d0e29fbc334e65786f547da4760428.exe

Resource

win10v2004-20230703-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  bca805f28e54c951189578d379dbe94366d0e29fbc334e65786f547da4760428
- Size
  
  833KB
- MD5
  
  20c7c9a0d90fee734d3824255bf09e45
- SHA1
  
  72ff70ab0dd20cad1d36ae4b1fffb5cdfe4ad73e
- SHA256
  
  bca805f28e54c951189578d379dbe94366d0e29fbc334e65786f547da4760428
- SHA512
  
  09f43d460c452980be87136264d9d63613f6fd4d02db68a48ff5d3f8542f45215c4315239d5c6354b59620bfb38be1febdd04ad87f20af9cb9783007844850d3
- SSDEEP
  
  24576:OkXRu60c+p0/B3jOjp9AcGpwJaS5mgLclZIOJQ7C8:DXR770sMjbAcOw6gw/9c
Score

10^/10

chinese_generic_botnet botnet persistence
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

chinese_generic_botnetbotnetpersistence

behavioral2

© 2018-2025

Terms | Privacy