chinese_generic_botnet | 62257fbcb2bd2f2cef70271cb1412d424adbd4565738fe29a5942de654f3b0d5 | Triage

Sharing

General

Target

9251c42a618a8db22fd9770b75c6291a
Size

388KB
Sample

240205-smqf5schar
MD5

9251c42a618a8db22fd9770b75c6291a
SHA1

4b3f7cd05a3a7610f020deaebd126ffae1aee869
SHA256

62257fbcb2bd2f2cef70271cb1412d424adbd4565738fe29a5942de654f3b0d5
SHA512

acb8ef6d33c4493ae7f4403580385ca322e54eafa6847a665655774edad3fcde51544f5f477c6bd0fa9d60ec72543ef4761a8225bd248d63cfa37485a0b0b806
SSDEEP

12288:oI46pmsJcRgXPAoc+ZljtOQEb+7aGGl5JIoo:oITZPQb3l5Jxo

Score

10^/10

chinese_generic_botnet botnet persistence

Malware Config

Targets

- Target
  
  “厦门”女推广在“柬”被关小黑屋遭电击轮奸视频.bat
- Size
  
  1.7MB
- MD5
  
  baa4b1972a62349d9d07c0f67705dad1
- SHA1
  
  f179ae5b3ad0e534017e237c8e4ffa8a1f24068d
- SHA256
  
  0108dfda636ea3e4767b39912125875976805997a727ec8248a2e93a44e3e113
- SHA512
  
  53c2f775d777306fe41de0e3c8c4fc6ed25a8a4eb41762485d8698c651960c2d8acf6c47984379938e67384d72e5cd1913cbc092a42e08b635fe03cd28420e29
- SSDEEP
  
  49152:zCZyIF04swEI8AUYMQ7fTXLvjnb/z3rOiG6eyWKuCma+5dxVJtBlZ9R1pkQco0gO:zIyIcCZi
Score

10^/10

chinese_generic_botnet botnet persistence
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

chinese_generic_botnetbotnet

behavioral2

chinese_generic_botnetbotnetpersistence