Overview

overview

10

Static

static

3

ba62dc3817...9b.exe

windows7-x64

10

ba62dc3817...9b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ba62dc3817b6fcd225d86a9eb2edeb10deb5ceb0e0e57c8dbfdd62b350e3009b

  • Size

    356KB

  • Sample

    231028-jhedmshc38

  • MD5

    a58db08c03bff00d61fe930e4db11be1

  • SHA1

    e77a4e507e26021c774d9fb9e72b9607a741e5e0

  • SHA256

    ba62dc3817b6fcd225d86a9eb2edeb10deb5ceb0e0e57c8dbfdd62b350e3009b

  • SHA512

    80b1c5442cfd4d4cb82479b66257673a613145453c022c77e3ee4598e996ec06d79dc00bcc3255f096a7846b8cd03cd283b0db1909725b5bbaea6f7366208cc5

  • SSDEEP

    3072:jAAdrtd9KDnHCc5cnFbAgpWli74j/zmbgYDa3S1jb+7sDAZ7Eik:hCCn4/y8YDa3Sh+7GAZS

Score
10/10
chinese_generic_botnetbotnetpersistence

Malware Config

Targets

    • Target

      ba62dc3817b6fcd225d86a9eb2edeb10deb5ceb0e0e57c8dbfdd62b350e3009b

    • Size

      356KB

    • MD5

      a58db08c03bff00d61fe930e4db11be1

    • SHA1

      e77a4e507e26021c774d9fb9e72b9607a741e5e0

    • SHA256

      ba62dc3817b6fcd225d86a9eb2edeb10deb5ceb0e0e57c8dbfdd62b350e3009b

    • SHA512

      80b1c5442cfd4d4cb82479b66257673a613145453c022c77e3ee4598e996ec06d79dc00bcc3255f096a7846b8cd03cd283b0db1909725b5bbaea6f7366208cc5

    • SSDEEP

      3072:jAAdrtd9KDnHCc5cnFbAgpWli74j/zmbgYDa3S1jb+7sDAZ7Eik:hCCn4/y8YDa3Sh+7GAZS

    Score
    10/10
    chinese_generic_botnetbotnetpersistence

    • Generic Chinese Botnet

      A botnet originating from China which is currently unnamed publicly.

      botnetchinese_generic_botnet

    • Chinese Botnet payload

      botnet

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks