Overview

overview

10

Static

static

3

968986bf64...e8.exe

windows7-x64

10

968986bf64...e8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    968986bf645698b0f3b430fea24b3082d9c8581e9458348fd2ddc38471982de8

  • Size

    5.8MB

  • Sample

    230810-nxep6scd84

  • MD5

    130f3875177c7e89a38c659d00680898

  • SHA1

    1281499f531c808ea9eb102369d7e8f95cbcd91f

  • SHA256

    968986bf645698b0f3b430fea24b3082d9c8581e9458348fd2ddc38471982de8

  • SHA512

    62d15331bbb804f5ac0302d5728b433e2f25e9f9f2d3d6c4d5eeac5a2d0f07abaffcab9ca542e021935fd63e464fcb3bcb42f97dca8158d74313621d929aeacc

  • SSDEEP

    98304:AqVQ4tml/iUm4XHb8vFtYkQgrSz9rAmLJHORm6UJamI3LeojzZARZpkAdcc6IjWF:/J+jX7oD/rSpru+W3KMZkvdagNXhJs0I

Score
10/10
chinese_generic_botnetbotnetpersistence

Malware Config

Targets

    • Target

      968986bf645698b0f3b430fea24b3082d9c8581e9458348fd2ddc38471982de8

    • Size

      5.8MB

    • MD5

      130f3875177c7e89a38c659d00680898

    • SHA1

      1281499f531c808ea9eb102369d7e8f95cbcd91f

    • SHA256

      968986bf645698b0f3b430fea24b3082d9c8581e9458348fd2ddc38471982de8

    • SHA512

      62d15331bbb804f5ac0302d5728b433e2f25e9f9f2d3d6c4d5eeac5a2d0f07abaffcab9ca542e021935fd63e464fcb3bcb42f97dca8158d74313621d929aeacc

    • SSDEEP

      98304:AqVQ4tml/iUm4XHb8vFtYkQgrSz9rAmLJHORm6UJamI3LeojzZARZpkAdcc6IjWF:/J+jX7oD/rSpru+W3KMZkvdagNXhJs0I

    Score
    10/10
    chinese_generic_botnetbotnetpersistence

    • Generic Chinese Botnet

      A botnet originating from China which is currently unnamed publicly.

      botnetchinese_generic_botnet

    • Chinese Botnet payload

      botnet

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks