chinese_generic_botnet | 4cc1ab70e6fd0d4441c778d40212c6e3114e14d56da85717214f8498e1c1501b | Triage

Submit
Reports

Overview

overview

Static

static

3

SecuriteIn...12.exe

windows7-x64

SecuriteIn...12.exe

windows10-2004-x64

3

Resubmissions

18-10-2024 20:35

241018-zc7q1axald 10

18-10-2024 20:24

241018-y6plvawflb 10

Sharing

General

Target

SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
Size

940KB
Sample

241018-y6plvawflb
MD5

b36366f4a27987d6de47887b03f29c68
SHA1

6f290bd6c132ec5c824558a29bdf75d25ced94e3
SHA256

4cc1ab70e6fd0d4441c778d40212c6e3114e14d56da85717214f8498e1c1501b
SHA512

a9441175872e88fc49482ef4707fad0e1f15a3ee1f4c74f3a2fafd3744968025d35ca61ed1905239a01df58511985e00708cdae7cb9acae4cca8b51032e02359
SSDEEP

24576:q4bDOphvGTO5+L0Un5cOoaPaoWXqEinqg4dNMBlqD9:HD2n+H5cOoUao+vib4rMu

Score

10^/10

chinese_generic_botnet botnet discovery

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe

Resource

win7-20240903-en

chinese_generic_botnet botnet discovery

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

1 signatures

150 seconds

Malware Config

Targets

- Target
  
  SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
- Size
  
  940KB
- MD5
  
  b36366f4a27987d6de47887b03f29c68
- SHA1
  
  6f290bd6c132ec5c824558a29bdf75d25ced94e3
- SHA256
  
  4cc1ab70e6fd0d4441c778d40212c6e3114e14d56da85717214f8498e1c1501b
- SHA512
  
  a9441175872e88fc49482ef4707fad0e1f15a3ee1f4c74f3a2fafd3744968025d35ca61ed1905239a01df58511985e00708cdae7cb9acae4cca8b51032e02359
- SSDEEP
  
  24576:q4bDOphvGTO5+L0Un5cOoaPaoWXqEinqg4dNMBlqD9:HD2n+H5cOoUao+vib4rMu
Score

10^/10

chinese_generic_botnet botnet discovery
- Generic Chinese Botnet
  A botnet originating from China which is currently unnamed publicly.
  botnet chinese_generic_botnet
- Chinese Botnet payload
  botnet
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

chinese_generic_botnetbotnetdiscovery

behavioral2

© 2018-2024

Terms | Privacy