Overview

overview

10

Static

static

956ed3d656...b2.exe

windows7_x64

10

956ed3d656...b2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    956ed3d65647e3c2ef5d8d2c765cc5b6af731fc921572a1a52cbff17e40bacb2

  • Size

    5.2MB

  • Sample

    220418-ydqy7sdack

  • MD5

    9b23553f7d72ad29c16700674f7ec980

  • SHA1

    95430ab8181b01887fee0f3091e00cdad4fa8a07

  • SHA256

    956ed3d65647e3c2ef5d8d2c765cc5b6af731fc921572a1a52cbff17e40bacb2

  • SHA512

    bc5f818d7209dc5ad37669d10568c496ad59a1d5ea65c937fbccc47f2f6aa56a872f6f0feaeae8d246b0e17a75326efd5c07844ba727755cf6f33f983841c94a

Score
10/10
loaderbotloaderminerpersistence

Malware Config

Targets

    • Target

      956ed3d65647e3c2ef5d8d2c765cc5b6af731fc921572a1a52cbff17e40bacb2

    • Size

      5.2MB

    • MD5

      9b23553f7d72ad29c16700674f7ec980

    • SHA1

      95430ab8181b01887fee0f3091e00cdad4fa8a07

    • SHA256

      956ed3d65647e3c2ef5d8d2c765cc5b6af731fc921572a1a52cbff17e40bacb2

    • SHA512

      bc5f818d7209dc5ad37669d10568c496ad59a1d5ea65c937fbccc47f2f6aa56a872f6f0feaeae8d246b0e17a75326efd5c07844ba727755cf6f33f983841c94a

    Score
    10/10
    loaderbotloaderminerpersistence

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

      loaderminerloaderbot

    • Detected Stratum cryptominer command

      Looks to be attempting to contact Stratum mining pool.

      miner

    • LoaderBot executable

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Cryptocurrency Miner

      Makes network request to known mining pool URL.

      miner

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks