chinese_generic_botnet | e3d105dc1dd582851c2c91cd4c0236224aca8a26670112e52750209527ef92aa | Triage

Submit
Reports

Overview

overview

Static

static

3

e3d105dc1d...aa.exe

windows7-x64

e3d105dc1d...aa.exe

windows10-2004-x64

Sharing

General

Target

e3d105dc1dd582851c2c91cd4c0236224aca8a26670112e52750209527ef92aa
Size

1.0MB
Sample

240623-lrtwss1hqm
MD5

5194004ec7dc8f3b91532982e07ed868
SHA1

58c3ab31d2c38e28939d0ff440dd567ba97a85c6
SHA256

e3d105dc1dd582851c2c91cd4c0236224aca8a26670112e52750209527ef92aa
SHA512

bd75ba602227ef1076ccb529c88cfd1d641fe21952f9796628e7dde31c1b0323cf45c267e1e350dacefd850c565bacfd13efc75147138f474c514f61582c3ac2
SSDEEP

3072:r3yG5wEOTetgIGjxyr3KMLu9vJGq0wSCKY2vMY2iudSZjuZj7QDYQG4jvmat896K:Tyq9ptgIsxITrY0QMuQDYQ9jv89Ak

Score

10^/10

chinese_generic_botnet botnet persistence

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

e3d105dc1dd582851c2c91cd4c0236224aca8a26670112e52750209527ef92aa.exe

Resource

win7-20240611-en

chinese_generic_botnet botnet

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

e3d105dc1dd582851c2c91cd4c0236224aca8a26670112e52750209527ef92aa.exe

Resource

win10v2004-20240508-en

chinese_generic_botnet botnet persistence

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  e3d105dc1dd582851c2c91cd4c0236224aca8a26670112e52750209527ef92aa
- Size
  
  1.0MB
- MD5
  
  5194004ec7dc8f3b91532982e07ed868
- SHA1
  
  58c3ab31d2c38e28939d0ff440dd567ba97a85c6
- SHA256
  
  e3d105dc1dd582851c2c91cd4c0236224aca8a26670112e52750209527ef92aa
- SHA512
  
  bd75ba602227ef1076ccb529c88cfd1d641fe21952f9796628e7dde31c1b0323cf45c267e1e350dacefd850c565bacfd13efc75147138f474c514f61582c3ac2
- SSDEEP
  
  3072:r3yG5wEOTetgIGjxyr3KMLu9vJGq0wSCKY2vMY2iudSZjuZj7QDYQG4jvmat896K:Tyq9ptgIsxITrY0QMuQDYQ9jv89Ak
Score

10^/10

chinese_generic_botnet botnet persistence
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

chinese_generic_botnetbotnet

behavioral2

chinese_generic_botnetbotnetpersistence

© 2018-2024

Terms | Privacy