Extracted

• • Target

    3366f49e175b09b95671d5330059d4908c9bf4ea33b065a82140f2d6fac3e7d3

  • Size

    2.1MB

  • MD5

    278397c0f6f7c7a08e4c4b05d62172ac

  • SHA1

    af6b16d7611719cb56e6b77739a1b088dfb3e0e2

  • SHA256

    3366f49e175b09b95671d5330059d4908c9bf4ea33b065a82140f2d6fac3e7d3

  • SHA512

    b5f474e4cc190d09e59445a5ff8cb15f67d29027010d061b94f1d3287edfc201e3aa4243c78c9372e457e939d5065aafe1394b97ac065d0c5e6615cffb7f1fd6

  • SSDEEP

    49152:nXWwcGf1oYidX/6V2sIvWh22Wy2+lq7ef6bgzqNNnUexrW:XWzGttDyC3qgMNUeU

  Score

  10^/10

  loaderbotxmrigloaderminerpersistencespywarestealer

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • LoaderBot executable

  • XMRig Miner payload

    miner

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Drops startup file

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence
  behavioral1behavioral2