Extracted

• • Target

    f4e4abc185d26f1bbb6f7c50245aace36bccf338a2f4e77ce358b36872079605

  • Size

    5.0MB

  • MD5

    8f36b3fba4e5d51d40026e16fbc7742e

  • SHA1

    00162dcf53957e496540b1c3fbc0ca2b02e7620b

  • SHA256

    f4e4abc185d26f1bbb6f7c50245aace36bccf338a2f4e77ce358b36872079605

  • SHA512

    2e67daea2946e8de5bb2fb9b91fac886569f4f9aeb9e39798c95466a326498bd41da9c09ba9cfe7f367f604eb51bc3f6b27becccf2b533d1d9e0318de6ba6be5

  • SSDEEP

    98304:CKTqoFhD35ATaYuL27df4TGBEGRWmybmIyvCFXQn1fzO+W:CmgaYuL27ReGBEGRWFbivcQ1Lw

  Score

  10^/10

  loaderbotxmrigloaderminerpersistence

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • LoaderBot executable

  • XMRig Miner payload

    miner

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1