General
- Target ify.exe
- Size 444KB
- Sample231012-v1ctbagc86
- SHA256 d555867e166d1e48bf13bc517f17565681c4a6ffdfde2a5eb9041b00b9164d8d
Score
10/10
Malware Config
Extracted
Family
-
originbotnet
C2
-
http://yingxnimetals.com/gate
Attributes
-
add_startup
true
-
download_folder_name
x5wsbycp.epf
-
hide_file_startup
true
-
startup_directory_name
snuXV
-
startup_environment_name
appdata
-
startup_installation_name
snuXV.exe
-
startup_registry_name
snuXV
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Targets
-
- Target ify.exe
- Size 444KB
- SHA256 d555867e166d1e48bf13bc517f17565681c4a6ffdfde2a5eb9041b00b9164d8d
Score10/10-
OriginBotnet
OriginBotnet is a remote access trojan written in C#.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext