Overview

overview

10

Static

static

7

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1fcc70d6e5d749e348b5edfd966cf0037cd4b73c331c82365d0191763fe13755

  • Size

    3.4MB

  • Sample

    231019-fgd5psfa68

  • MD5

    65af1033a01110ec64468bacbe3a7607

  • SHA1

    9d1f8c17ce63803245c02a0e679ccde3fafcd48a

  • SHA256

    2531116b30534eb043a27f83fb4abdec24d212cf58673c117850256510f21264

  • SHA512

    9cd3932957dbf748793b9529e1f051532503c4cdef81f67cf86679b8415b92f90fbcae6f2473fb6c125de570dca0e501d11fca37ce4a9b8f554c8e22db322e54

  • SSDEEP

    98304:xWoz95vq28HVaKCJj1z2ge+u/3qXuD5OxBBkyWBh:oQZyahJ4g3uPIuFKayu

Score
10/10
loaderbotxmrigevasionloaderminerpersistencethemidatrojan

Malware Config

Targets

    • Target

      1fcc70d6e5d749e348b5edfd966cf0037cd4b73c331c82365d0191763fe13755

    • Size

      3.4MB

    • MD5

      65af1033a01110ec64468bacbe3a7607

    • SHA1

      9d1f8c17ce63803245c02a0e679ccde3fafcd48a

    • SHA256

      2531116b30534eb043a27f83fb4abdec24d212cf58673c117850256510f21264

    • SHA512

      9cd3932957dbf748793b9529e1f051532503c4cdef81f67cf86679b8415b92f90fbcae6f2473fb6c125de570dca0e501d11fca37ce4a9b8f554c8e22db322e54

    • SSDEEP

      98304:xWoz95vq28HVaKCJj1z2ge+u/3qXuD5OxBBkyWBh:oQZyahJ4g3uPIuFKayu

    Score
    10/10
    loaderbotxmrigevasionloaderminerpersistencethemidatrojan

    • Detects DLL dropped by Raspberry Robin.

      Raspberry Robin.

    • LoaderBot

      LoaderBot is a loader written in .NET downloading and executing miners.

      loaderminerloaderbot

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • LoaderBot executable

    • XMRig Miner payload

      miner

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks