Overview

overview

10

Static

static

3

db44e707e4...bf.exe

windows7-x64

10

db44e707e4...bf.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    db44e707e44acd97873977cbf40e96db1b3695e2674fb338384ba62f38fd19bf

  • Size

    828KB

  • Sample

    240329-sjx2tabb5x

  • MD5

    fd8e47b837b0cabc437527611971f5cd

  • SHA1

    98e349e25617fe03669c079a19272d782d2b875d

  • SHA256

    db44e707e44acd97873977cbf40e96db1b3695e2674fb338384ba62f38fd19bf

  • SHA512

    2aadd0c574ab773ed1bdb587d45bed58bf330a0df72c28147dfea542012a5185e06b387a9a085fd45e3619d17fe895a41cbe4014e054be0dc2d10fc71b654485

  • SSDEEP

    24576:ZY6NjevRskkgMm+rq/zRg9K3xXXIZ2qLLJ:ZjK+OBFXIHN

Score
10/10
chinese_generic_botnetbotnetpersistence

Malware Config

Targets

    • Target

      db44e707e44acd97873977cbf40e96db1b3695e2674fb338384ba62f38fd19bf

    • Size

      828KB

    • MD5

      fd8e47b837b0cabc437527611971f5cd

    • SHA1

      98e349e25617fe03669c079a19272d782d2b875d

    • SHA256

      db44e707e44acd97873977cbf40e96db1b3695e2674fb338384ba62f38fd19bf

    • SHA512

      2aadd0c574ab773ed1bdb587d45bed58bf330a0df72c28147dfea542012a5185e06b387a9a085fd45e3619d17fe895a41cbe4014e054be0dc2d10fc71b654485

    • SSDEEP

      24576:ZY6NjevRskkgMm+rq/zRg9K3xXXIZ2qLLJ:ZjK+OBFXIHN

    Score
    10/10
    chinese_generic_botnetbotnetpersistence

    • Generic Chinese Botnet

      A botnet originating from China which is currently unnamed publicly.

      botnetchinese_generic_botnet

    • Chinese Botnet payload

      botnet

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks