General

  • Target

    4e9a2e0dbcbd228d719037aa6320cbf5a37ba98e0620613f71e572ec7fba7b4a

  • Size

    16KB

  • Sample

    220720-vl491scfaq

  • MD5

    3c6ccad2b6665c5a4469ba535aa77609

  • SHA1

    f88b51c5d63ff252b4cf4fe0bb9c2ac72f06fb07

  • SHA256

    4e9a2e0dbcbd228d719037aa6320cbf5a37ba98e0620613f71e572ec7fba7b4a

  • SHA512

    478d5a2c6370e5c3b8ecef4b8a30955209b32f19f3fb681e87e66ce498f2013110a5c3febef8a098470adf9e36e224508aa09f178cad161f3000aea59d6e4130

  • SSDEEP

    384:EyXvpPCuH19GTXjdhhPuujYcV6AUwJFZb:EKVlV9Ah5fYcV6Dw9b

Malware Config

Extracted

Family

loaderbot

C2

https://fruitive-women.000webhostapp.com/cmd.php

Targets

    • Target

      4e9a2e0dbcbd228d719037aa6320cbf5a37ba98e0620613f71e572ec7fba7b4a

    • Size

      16KB

    • MD5

      3c6ccad2b6665c5a4469ba535aa77609

    • SHA1

      f88b51c5d63ff252b4cf4fe0bb9c2ac72f06fb07

    • SHA256

      4e9a2e0dbcbd228d719037aa6320cbf5a37ba98e0620613f71e572ec7fba7b4a

    • SHA512

      478d5a2c6370e5c3b8ecef4b8a30955209b32f19f3fb681e87e66ce498f2013110a5c3febef8a098470adf9e36e224508aa09f178cad161f3000aea59d6e4130

    • SSDEEP

      384:EyXvpPCuH19GTXjdhhPuujYcV6AUwJFZb:EKVlV9Ah5fYcV6Dw9b

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

    • LoaderBot executable

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks