chinese_generic_botnet | 8ab29d462bedfcb4b4174f2b7a41fe683ba0b6904a09902583ec7a7464964732 | Triage

Submit
Reports

Overview

overview

Static

static

3

cryptolaemus

windows10-2004-x64

cryptolaemus

windows11-21h2-x64

Sharing

General

Target

8ab29d462bedfcb4b4174f2b7a41fe683ba0b6904a09902583ec7a7464964732
Size

2.0MB
Sample

240319-xgq8psbg56
MD5

9f914e571b5b4fb328008dc5793715e7
SHA1

c321f44fbb74204e0324fcee5c54b3ae10434e20
SHA256

8ab29d462bedfcb4b4174f2b7a41fe683ba0b6904a09902583ec7a7464964732
SHA512

a6b0e32d0aa1ef6898ac1f4d20f4f3a1b3fce912c5e3becf1d1ca5f01d6ac21265f1e521bf2c4f7fe686d7807adb8eaf0090e1e6c312e8cea3eaa43a6f48aba8
SSDEEP

24576:UXzUbSX5Z/IYno0dbnnmrtyF2ZifBvlGsu6ot9vtC1FoV1pltylcVHhE9HHWAjh3:UX4uXjo0ZCUFN5vUikV1XacrEY3M7TFJ

Score

10^/10

chinese_generic_botnet botnet persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

8ab29d462bedfcb4b4174f2b7a41fe683ba0b6904a09902583ec7a7464964732.exe

Resource

win10v2004-20240226-en

chinese_generic_botnet botnet persistence

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral2

Sample

8ab29d462bedfcb4b4174f2b7a41fe683ba0b6904a09902583ec7a7464964732.exe

Resource

win11-20240221-en

chinese_generic_botnet botnet persistence

windows11-21h2-x64

9 signatures

150 seconds

Malware Config

Targets

- Target
  
  8ab29d462bedfcb4b4174f2b7a41fe683ba0b6904a09902583ec7a7464964732
- Size
  
  2.0MB
- MD5
  
  9f914e571b5b4fb328008dc5793715e7
- SHA1
  
  c321f44fbb74204e0324fcee5c54b3ae10434e20
- SHA256
  
  8ab29d462bedfcb4b4174f2b7a41fe683ba0b6904a09902583ec7a7464964732
- SHA512
  
  a6b0e32d0aa1ef6898ac1f4d20f4f3a1b3fce912c5e3becf1d1ca5f01d6ac21265f1e521bf2c4f7fe686d7807adb8eaf0090e1e6c312e8cea3eaa43a6f48aba8
- SSDEEP
  
  24576:UXzUbSX5Z/IYno0dbnnmrtyF2ZifBvlGsu6ot9vtC1FoV1pltylcVHhE9HHWAjh3:UX4uXjo0ZCUFN5vUikV1XacrEY3M7TFJ
Score

10^/10

chinese_generic_botnet botnet persistence
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

chinese_generic_botnetbotnetpersistence

behavioral2

chinese_generic_botnetbotnetpersistence

© 2018-2024

Terms | Privacy