General

  • Target

    4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390

  • Size

    16KB

  • Sample

    220708-hhjspadfej

  • MD5

    9c5088af14da209f0a78ca828ad16e97

  • SHA1

    8955e3530454adc88e36183ec26b36cf48138c3c

  • SHA256

    4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390

  • SHA512

    a8986849183c61ac2643186614284a6620501bae3dee3c1a9c6a55f5aa7b5cc2b5b4456227bbbda39d2103ea84d2c91a1d185ad90603519e93ac6ffeab328a79

  • SSDEEP

    384:OKBvkPHxH19GTXjdhknuujYcV6AUwJFZb:OYeRV9Ah6fYcV6Dw9b

Malware Config

Extracted

Family

loaderbot

C2

http://user78171.7ci.ru/cmd.php

Targets

    • Target

      4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390

    • Size

      16KB

    • MD5

      9c5088af14da209f0a78ca828ad16e97

    • SHA1

      8955e3530454adc88e36183ec26b36cf48138c3c

    • SHA256

      4121794e6c8ffbf1a29d3dee1d0901b1682cd634f37502218739b78652a4a390

    • SHA512

      a8986849183c61ac2643186614284a6620501bae3dee3c1a9c6a55f5aa7b5cc2b5b4456227bbbda39d2103ea84d2c91a1d185ad90603519e93ac6ffeab328a79

    • SSDEEP

      384:OKBvkPHxH19GTXjdhknuujYcV6AUwJFZb:OYeRV9Ah6fYcV6Dw9b

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

    • LoaderBot executable

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks