loaderbot

General

Target

49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0
Size

2.8MB
Sample

220701-g8wphafhdm
MD5

fd6c40dbd747bdce483fd0e8d36912fe
SHA1

596cecba374b8ff52c06eac846853537860b8aeb
SHA256

49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0
SHA512

c86284ac889facde7f5ec11901ec7d7a48a275e739e6b8985e5b0a0bab5a98b13c31fd2382429f365cb3e27c432e37b8404bf63c76bfc255c215210e656e4fd5

Score

10^/10

Malware Config

Targets

- Target
  
  49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0
- Size
  
  2.8MB
- MD5
  
  fd6c40dbd747bdce483fd0e8d36912fe
- SHA1
  
  596cecba374b8ff52c06eac846853537860b8aeb
- SHA256
  
  49ac7233602bbdc3f70f9b5f68cc99a1e79768013f3abcc68a594da4aee873f0
- SHA512
  
  c86284ac889facde7f5ec11901ec7d7a48a275e739e6b8985e5b0a0bab5a98b13c31fd2382429f365cb3e27c432e37b8404bf63c76bfc255c215210e656e4fd5
Score

10^/10

loaderbot xmrig loader miner persistence suricata upx
- LoaderBot
  LoaderBot is a loader written in .NET downloading and executing miners.
  loader miner loaderbot
- suricata: ET MALWARE CerberTear Ransomware CnC Checkin
  suricata: ET MALWARE CerberTear Ransomware CnC Checkin
  suricata
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- LoaderBot executable
- XMRig Miner Payload
  miner
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

suricata: ET MALWARE CerberTear Ransomware CnC Checkin

xmrig

LoaderBot executable

XMRig Miner Payload

Executes dropped EXE

UPX packed file

Checks computer location settings

Drops startup file

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2