Overview

overview

10

Static

static

1

af9fc2b7a5...2e.exe

windows7_x64

1

af9fc2b7a5...2e.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af9fc2b7a55bc075676961e4b8173d2f5f1078aa6909713a690ad52b514ad62e

  • Size

    8.0MB

  • Sample

    220524-sc3nqafdb6

  • MD5

    9b78e45d2fb3ceca20edf9cb27182cbe

  • SHA1

    ae0c759cfe53dfc77114925d7c062b9f49f5cac0

  • SHA256

    af9fc2b7a55bc075676961e4b8173d2f5f1078aa6909713a690ad52b514ad62e

  • SHA512

    0eaddb819261bd6b53c6474f5ad3fc6e82d4f8fbb828b8fbf71e5cd098f8bf6d7e449c2a9a636bb0182669f1b9bdc5ebc6608da2b44ab1fe18233ca0d182c3e4

Score
10/10
loaderbotloaderminerpersistence

Malware Config

Targets

    • Target

      af9fc2b7a55bc075676961e4b8173d2f5f1078aa6909713a690ad52b514ad62e

    • Size

      8.0MB

    • MD5

      9b78e45d2fb3ceca20edf9cb27182cbe

    • SHA1

      ae0c759cfe53dfc77114925d7c062b9f49f5cac0

    • SHA256

      af9fc2b7a55bc075676961e4b8173d2f5f1078aa6909713a690ad52b514ad62e

    • SHA512

      0eaddb819261bd6b53c6474f5ad3fc6e82d4f8fbb828b8fbf71e5cd098f8bf6d7e449c2a9a636bb0182669f1b9bdc5ebc6608da2b44ab1fe18233ca0d182c3e4

    Score
    10/10
    loaderbotloaderminerpersistence

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

      loaderminerloaderbot

    • LoaderBot executable

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks