General

  • Target

    1fd9ff46da9bc4bfdc2fb4d990068500e9c68293eb9509ea5164832f4b2bebf7

  • Size

    16KB

  • Sample

    220612-t1hh5abhc2

  • MD5

    b62ad5096a4d3d518728bd35daf2eaf0

  • SHA1

    4f8fceb017f26cecdc109563b41f8118c64db7dd

  • SHA256

    1fd9ff46da9bc4bfdc2fb4d990068500e9c68293eb9509ea5164832f4b2bebf7

  • SHA512

    e4eaa6726d6f34364e206d991a6e7c730e4301c6e1de2d58523ca5819f598a92c64f39fa54b2a0afd6684288c640356722a412433ad912ae944a1002f732bec5

  • SSDEEP

    384:yKBvkPHxH19GTXjdh5luujYcV6AUwJFZb:yYeRV9AhzfYcV6Dw9b

Malware Config

Extracted

Family

loaderbot

C2

http://user79913.7ci.ru/cmd.php

Targets

    • Target

      1fd9ff46da9bc4bfdc2fb4d990068500e9c68293eb9509ea5164832f4b2bebf7

    • Size

      16KB

    • MD5

      b62ad5096a4d3d518728bd35daf2eaf0

    • SHA1

      4f8fceb017f26cecdc109563b41f8118c64db7dd

    • SHA256

      1fd9ff46da9bc4bfdc2fb4d990068500e9c68293eb9509ea5164832f4b2bebf7

    • SHA512

      e4eaa6726d6f34364e206d991a6e7c730e4301c6e1de2d58523ca5819f598a92c64f39fa54b2a0afd6684288c640356722a412433ad912ae944a1002f732bec5

    • SSDEEP

      384:yKBvkPHxH19GTXjdh5luujYcV6AUwJFZb:yYeRV9AhzfYcV6Dw9b

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

    • LoaderBot executable

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks