General

  • Target

    5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d

  • Size

    16KB

  • Sample

    220802-bn1vtsdaa3

  • MD5

    8f9db1d76c8ebcd539121678fd28554d

  • SHA1

    446d66da8b0978f6d51cf20cf992a05356c9185a

  • SHA256

    5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d

  • SHA512

    553382301e7510ba6e461b918ad2c5397ee754ac8128359021b4b6f148a65eae99c022a7a2b53820bed304992f9fc873650d0cf90c40ff9f24d20e30f1f8c20c

  • SSDEEP

    384:bm9vAPDVH19GTXjdhiMuujYcV6AUwJFZb:bgyRV9Ah/fYcV6Dw9b

Malware Config

Extracted

Family

loaderbot

C2

http://ih894017.myihor.ru/cmd.php

Targets

    • Target

      5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d

    • Size

      16KB

    • MD5

      8f9db1d76c8ebcd539121678fd28554d

    • SHA1

      446d66da8b0978f6d51cf20cf992a05356c9185a

    • SHA256

      5b0b780a1caa13c737099f0d389e682cb74e63e62ae53eeed29167e74833977d

    • SHA512

      553382301e7510ba6e461b918ad2c5397ee754ac8128359021b4b6f148a65eae99c022a7a2b53820bed304992f9fc873650d0cf90c40ff9f24d20e30f1f8c20c

    • SSDEEP

      384:bm9vAPDVH19GTXjdhiMuujYcV6AUwJFZb:bgyRV9Ah/fYcV6Dw9b

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

    • LoaderBot executable

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks