Extracted

• • Target

    f0223602cace0eca2057e28ffdc6f76799802e389a081c657436578fea0e3262

  • Size

    4.6MB

  • MD5

    ecc0d99e2a9f0415d82e96cf2d6ba555

  • SHA1

    f3d3422224218418a46db7170cc541721707c07e

  • SHA256

    f0223602cace0eca2057e28ffdc6f76799802e389a081c657436578fea0e3262

  • SHA512

    e729d7eed19baa944b515957504471e6993f2d8cf4201ef885009ece2d3e27de86119685cd8021f886eece6812aac8cf640f92e33e582920ec53b7778121a01a

  • SSDEEP

    98304:YbG9gDSxEguMUJVFyjBspd7i4nwISLNLbbShsPMN7xRp9gKzawWzi:WStuMURyjCvtwIGXShRN7x39gKzDWzi

  Score

  10^/10

  loaderbotxmrigloaderminerpersistence

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • LoaderBot executable

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2