chinese_generic_botnet | 9553e9d5c162ee6bc5ebe0461a87e5d9d1c66c5be38c3293050d87cf8d048ca0 | Triage

Submit
Reports

Overview

overview

Static

static

9553e9d5c1...a0.exe

windows7-x64

9553e9d5c1...a0.exe

windows10-2004-x64

Sharing

General

Target

9553e9d5c162ee6bc5ebe0461a87e5d9d1c66c5be38c3293050d87cf8d048ca0
Size

3.3MB
Sample

240722-b8pnasvbqa
MD5

8ca55e334f4679e6aadc101833a19a38
SHA1

1b47cf80bfa6c7cb6f72fc0a1046e7ffa91b26a3
SHA256

9553e9d5c162ee6bc5ebe0461a87e5d9d1c66c5be38c3293050d87cf8d048ca0
SHA512

2ebfb891c70f544e1e886d2a98478cdae213323fdc6e741c0dc4082d929ff028fa2fbabe2bcab3f6e365085267da8b55d74af8142c994cf633752624b98e7892
SSDEEP

49152:m/CKxi03zDWi26fs2cWDAbcl7j1v4+9Ry4kjC+Fn05Ricx4PHzLbf:m/CKT0uDhVv4n4MbFn05Ricx4PHzLb

Score

10^/10

chinese_generic_botnet aspackv2 botnet persistence

Static task

static1

botnet chinese_generic_botnet

3 signatures

Behavioral task

behavioral1

Sample

9553e9d5c162ee6bc5ebe0461a87e5d9d1c66c5be38c3293050d87cf8d048ca0.exe

Resource

win7-20240704-en

chinese_generic_botnet aspackv2 botnet

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

9553e9d5c162ee6bc5ebe0461a87e5d9d1c66c5be38c3293050d87cf8d048ca0.exe

Resource

win10v2004-20240709-en

chinese_generic_botnet aspackv2 botnet persistence

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  9553e9d5c162ee6bc5ebe0461a87e5d9d1c66c5be38c3293050d87cf8d048ca0
- Size
  
  3.3MB
- MD5
  
  8ca55e334f4679e6aadc101833a19a38
- SHA1
  
  1b47cf80bfa6c7cb6f72fc0a1046e7ffa91b26a3
- SHA256
  
  9553e9d5c162ee6bc5ebe0461a87e5d9d1c66c5be38c3293050d87cf8d048ca0
- SHA512
  
  2ebfb891c70f544e1e886d2a98478cdae213323fdc6e741c0dc4082d929ff028fa2fbabe2bcab3f6e365085267da8b55d74af8142c994cf633752624b98e7892
- SSDEEP
  
  49152:m/CKxi03zDWi26fs2cWDAbcl7j1v4+9Ry4kjC+Fn05Ricx4PHzLbf:m/CKT0uDhVv4n4MbFn05Ricx4PHzLb
Score

10^/10

chinese_generic_botnet aspackv2 botnet persistence
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

botnetchinese_generic_botnet

behavioral1

chinese_generic_botnetaspackv2botnet

behavioral2

chinese_generic_botnetaspackv2botnetpersistence

© 2018-2024

Terms | Privacy