chinese_generic_botnet | 3880ab895d1db72cb125a1837cdb37b7d0637d41ecbd0bd6adadbe8d959f2f23

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 14:46

Target

3880ab895d1db72cb125a1837cdb37b7d0637d41ecbd0bd6adadbe8d959f2f23.exe
Size

808KB
MD5

8d323d9169980e214dd6ecd8c709249a
SHA1

d232b0e7b71564b59e9bfc76806b252c443d548f
SHA256

3880ab895d1db72cb125a1837cdb37b7d0637d41ecbd0bd6adadbe8d959f2f23
SHA512

ee2c6242aa432bdbfe3769a92b8092fbaad831971847918f776166f8c4430c879435de489fe2052d70128a3ce26de9933e06025d89ab010fcea9850decb2dc35
SSDEEP

6144:n3jsF2Lea5ec5QQLCR3Gfzw8LczTdBQgosbJwmatr8BWLs1A:M2LpMc5TLCQcTQcwQELR

Score

10^/10

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral1/memory/1956-0-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

3880ab895d1db72cb125a1837cdb37b7d0637d41ecbd0bd6adadbe8d959f2f23.exe

pid	Process
1956	3880ab895d1db72cb125a1837cdb37b7d0637d41ecbd0bd6adadbe8d959f2f23.exe

C:\Users\Admin\AppData\Local\Temp\3880ab895d1db72cb125a1837cdb37b7d0637d41ecbd0bd6adadbe8d959f2f23.exe
"C:\Users\Admin\AppData\Local\Temp\3880ab895d1db72cb125a1837cdb37b7d0637d41ecbd0bd6adadbe8d959f2f23.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1956

memory/1956-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download