chinese_generic_botnet | b4d51b0354e7508d723396fa6affd92b5108fa3cd27ecd4c86001a5ffb999cb8 | Triage

Submit
Reports

Overview

overview

Static

static

3

b4d51b0354...b8.exe

windows7-x64

b4d51b0354...b8.exe

windows10-2004-x64

Sharing

General

Target

b4d51b0354e7508d723396fa6affd92b5108fa3cd27ecd4c86001a5ffb999cb8
Size

1.8MB
Sample

231115-m17dxsga46
MD5

108fde1527d48fabd718d3b25d58ce40
SHA1

fdd49fafb3fc40b700204f60d754143468762f4d
SHA256

b4d51b0354e7508d723396fa6affd92b5108fa3cd27ecd4c86001a5ffb999cb8
SHA512

140a12f14e3733a4a2989dccf645033e628684bcd4c56e63c7d2d22ed2893ce71e986e6c1ef04fde121125dbed128d48245d121980ac0bceb2fe7fdc809e6e04
SSDEEP

12288:uvTIiUxmYh90jjAblb1yHy8ZV0Lug6BtPtzFS30pS6zxgIsxITrLpyPYCSXh1M2p:ubIiCm898jGyS8RY3VSdsxIPL1/xUU

Score

10^/10

chinese_generic_botnet botnet persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

b4d51b0354e7508d723396fa6affd92b5108fa3cd27ecd4c86001a5ffb999cb8.exe

Resource

win7-20231023-en

chinese_generic_botnet botnet

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

b4d51b0354e7508d723396fa6affd92b5108fa3cd27ecd4c86001a5ffb999cb8.exe

Resource

win10v2004-20231023-en

chinese_generic_botnet botnet persistence

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  b4d51b0354e7508d723396fa6affd92b5108fa3cd27ecd4c86001a5ffb999cb8
- Size
  
  1.8MB
- MD5
  
  108fde1527d48fabd718d3b25d58ce40
- SHA1
  
  fdd49fafb3fc40b700204f60d754143468762f4d
- SHA256
  
  b4d51b0354e7508d723396fa6affd92b5108fa3cd27ecd4c86001a5ffb999cb8
- SHA512
  
  140a12f14e3733a4a2989dccf645033e628684bcd4c56e63c7d2d22ed2893ce71e986e6c1ef04fde121125dbed128d48245d121980ac0bceb2fe7fdc809e6e04
- SSDEEP
  
  12288:uvTIiUxmYh90jjAblb1yHy8ZV0Lug6BtPtzFS30pS6zxgIsxITrLpyPYCSXh1M2p:ubIiCm898jGyS8RY3VSdsxIPL1/xUU
Score

10^/10

chinese_generic_botnet botnet persistence
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

chinese_generic_botnetbotnet

behavioral2

chinese_generic_botnetbotnetpersistence

© 2018-2025

Terms | Privacy