loaderbot | 2648-24-0x0000000000E00000-0x0000000001834000-memory[.]dmp

General

Target
2648-24-0x0000000000E00000-0x0000000001834000-memory.dmp
Size 10.2MB
Sample231022-p4gnsaab76
SHA256 2425703be93685d101d68f68f005c25b61330cfc3efc017e984630cde7760c79
MD5 02b4c592b543df48b80a09946a001aab
SHA1 14f6d57fd3d15623e426c82d56a349765df67dff
SHA512 3bdfcbad1c13e534d8c587a0bbf148489c3d081a84372b8ad82818bdc0d95b71bb8d10c5dac50c1422ef073c0021efb7951828c5ebf936363075dad2e44748c6
SSDEEP 98304:nzP88fBsnZTgOtqB3m1RC3hORpug4ORd0Xw4bBv+eszWpJj1z2ge+u/3qXuD5Oxc:DrpkE3aRC32f4bprsyJ4g3uPIuFKay
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

LoaderBot executable 1 IoCs

resource	yara_rule
sample	loaderbot

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2648-24-0x0000000000E00000-0x0000000001834000-memory.dmp

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 2425703be93685d101d68f68f005c25b61330cfc3efc017e984630cde7760c79
MD5 02b4c592b543df48b80a09946a001aab
SHA1 14f6d57fd3d15623e426c82d56a349765df67dff
SHA512 3bdfcbad1c13e534d8c587a0bbf148489c3d081a84372b8ad82818bdc0d95b71bb8d10c5dac50c1422ef073c0021efb7951828c5ebf936363075dad2e44748c6
SSDEEP 98304:nzP88fBsnZTgOtqB3m1RC3hORpug4ORd0Xw4bBv+eszWpJj1z2ge+u/3qXuD5Oxc:DrpkE3aRC32f4bprsyJ4g3uPIuFKay
MD5 SHA1 SHA512 SSDEEP

LoaderBot executable
Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4162158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths