Overview

overview

10

Static

static

7

c791f08fd7...01.exe

windows7-x64

10

c791f08fd7...01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c791f08fd767a7dcde7f15e1c09080ebdfadfe4189784347ee605df7db617a01

  • Size

    2.3MB

  • Sample

    240110-lvpfgsdbbk

  • MD5

    006298721ac79417f93e8c1252add3e5

  • SHA1

    cd70766c3b15e72da33b9d23d881e01b75ce8e37

  • SHA256

    c791f08fd767a7dcde7f15e1c09080ebdfadfe4189784347ee605df7db617a01

  • SHA512

    71a0096e4d96a00ff442940073656233e0a83a9927791e632ab7b613d7767a316382dd201523be005eec886765d54e5607420de44b3b24fff8ea88536d551fff

  • SSDEEP

    49152:QoIshg0ECkpEoOd1CQZeOMmHptpmOGPVQnPUVYdQ3Nlcnc:QAhgaipOd1CqlMyMgPUudUWc

Score
10/10
chinese_generic_botnetbotnetevasionpersistencethemidatrojan

Malware Config

Targets

    • Target

      c791f08fd767a7dcde7f15e1c09080ebdfadfe4189784347ee605df7db617a01

    • Size

      2.3MB

    • MD5

      006298721ac79417f93e8c1252add3e5

    • SHA1

      cd70766c3b15e72da33b9d23d881e01b75ce8e37

    • SHA256

      c791f08fd767a7dcde7f15e1c09080ebdfadfe4189784347ee605df7db617a01

    • SHA512

      71a0096e4d96a00ff442940073656233e0a83a9927791e632ab7b613d7767a316382dd201523be005eec886765d54e5607420de44b3b24fff8ea88536d551fff

    • SSDEEP

      49152:QoIshg0ECkpEoOd1CQZeOMmHptpmOGPVQnPUVYdQ3Nlcnc:QAhgaipOd1CqlMyMgPUudUWc

    Score
    10/10
    chinese_generic_botnetbotnetevasionthemidatrojanpersistence

    • Generic Chinese Botnet

      A botnet originating from China which is currently unnamed publicly.

      botnetchinese_generic_botnet

    • Chinese Botnet payload

      botnet

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks