Overview

overview

10

Static

static

10

c9146e423c...8d.exe

windows7-x64

10

c9146e423c...8d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c9146e423c92744eb2960112b45bdbd59f2cbd2ac99d388ab1cafd78181f028d

  • Size

    16KB

  • Sample

    220731-kyrjksacfm

  • MD5

    6bd58a85b177f63258c7e23abc6857a0

  • SHA1

    4b72403d1fb6cd8b685e6453f8734e8a74b2568b

  • SHA256

    c9146e423c92744eb2960112b45bdbd59f2cbd2ac99d388ab1cafd78181f028d

  • SHA512

    cd3dc83bce9bb634a0dfdbf2c074df1d9e1a12773c412cfab765694f4e7873527675b40a271fa751879baf0ea8eb7bc8a071a8a90ff1290bb96f3eca2b39705a

  • SSDEEP

    384:DWxvd9PWblH19GTXjdh9mnuujYcV6AUwJFZb:DUfeV9AhEfYcV6Dw9b

Score
10/10
loaderbotloaderminerpersistence

Malware Config

Extracted

Family

loaderbot

C2

http://user79675.7ci.ru/cmd.php

Targets

    • Target

      c9146e423c92744eb2960112b45bdbd59f2cbd2ac99d388ab1cafd78181f028d

    • Size

      16KB

    • MD5

      6bd58a85b177f63258c7e23abc6857a0

    • SHA1

      4b72403d1fb6cd8b685e6453f8734e8a74b2568b

    • SHA256

      c9146e423c92744eb2960112b45bdbd59f2cbd2ac99d388ab1cafd78181f028d

    • SHA512

      cd3dc83bce9bb634a0dfdbf2c074df1d9e1a12773c412cfab765694f4e7873527675b40a271fa751879baf0ea8eb7bc8a071a8a90ff1290bb96f3eca2b39705a

    • SSDEEP

      384:DWxvd9PWblH19GTXjdh9mnuujYcV6AUwJFZb:DUfeV9AhEfYcV6Dw9b

    Score
    10/10
    loaderbotloaderminerpersistence

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

      loaderminerloaderbot

    • LoaderBot executable

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks