chinese_generic_botnet | bf0a25bd28c07a323c4ffbb47c1da0ab5ca610ba8b6be2898ca5beba7be9b01a

General

Target

bf0a25bd28c07a323c4ffbb47c1da0ab5ca610ba8b6be2898ca5beba7be9b01a
Size

10.2MB
Sample

231117-s5p84abe4v
MD5

acef2ad4700778ef94a3bbb49458b43a
SHA1

46cb2da6ef3f034c7fa797bf9f8102a12d9b94fd
SHA256

bf0a25bd28c07a323c4ffbb47c1da0ab5ca610ba8b6be2898ca5beba7be9b01a
SHA512

95f43e6b460c54b797690bef417ce33238fd8dcdbcf9575af1cbf83fc307e5c731f33449ef16881dd0eb6aa93a92847e8311c0b0b4f659faf6db1ad9b894e987
SSDEEP

196608:VMgSAC0uyapvc52vBS8Vat1IMVoIAtlL04MjCuj6j32nuA0exI7AkA:VMgSj0uB6wpS8VanIttlY4ruh5xqhA

Score

10^/10

Malware Config

Targets

- Target
  
  加速器破解/BGX工具SST6.0.exe
- Size
  
  10.2MB
- MD5
  
  10ab9fec8e62f1b7e41d146aeb18c8f8
- SHA1
  
  579faaf7240d10375ab8adf42d1929012eee66f7
- SHA256
  
  9a9574689b84a2bc9e715b50faaf7dd34f7a2d293be29adc83fdea8b258d355f
- SHA512
  
  cc248db1ae7298c66302397699862d55950556f5abe404aeea35fa4da2b48ff804e401a65d230469d406e06c5a22f153d77b558709341829c15a74a89df30273
- SSDEEP
  
  196608:9j43XIaq+hL9gpJm8vxpDU9M6zAcvov7AVC6TyNcCW+EfI6HC6KQnS:63XZqu+jxDDUlA1kVFOeCfEfvHC6JnS
Score

1^/10
behavioral1 behavioral2
- Target
  
  加速器破解/破解补丁.exe
- Size
  
  1.7MB
- MD5
  
  3a740fd4be0cf91afb6b24578377831b
- SHA1
  
  13672b2c077adab7132243ad5668b790d97542a9
- SHA256
  
  098d2e56d29568e907b5df84ca8cd629fb5e24ec1f612b60133dda9063ce8aef
- SHA512
  
  b3d9821e2677d9a696548a65ea842b9bac2cec5b616f0162c53c83a1da9bf64beddfe4a46fcb901ba8490d9abe6d02e8cb88c57c8864a91981b27a6ae84de0ae
- SSDEEP
  
  12288:2G/0XYg0NtX46rHjOe7Sy5oFUEv6xgIsxITrLSRfWP5x0c:2G8XY5NF4sjP152Ua6dsxI8f05v
Score

10^/10

chinese_generic_botnet botnet persistence
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory
behavioral3 behavioral4