Extracted

• • Target

    tmp

  • Size

    72KB

  • MD5

    ca24ecfb4ed0c1d4f6e2f9451943aa81

  • SHA1

    82efc58779cf1ba0736ecbffd35798e58e9658c3

  • SHA256

    87af3f03355baa7ed121958ee760ca52dbde2671532b582cc927f31eba6612ea

  • SHA512

    1522c4e421f98303e39d103a2d30a6ade398e2c804d6cd22a5e23b7abc23b4ffa8e340c5f2664e02dca18d809bb62d67c8ad60e15ce30a7bf5d8a23d59b39bcb

  • SSDEEP

    1536:0h168mCWXWnz3Fu/JzVTjhy4D/i4i+wpsTa+Cq45ijI3BBxfZ:SLmCWmnZuxzVxye/iIa+Cqu3Bh

  Score

  10^/10

  loaderbotxmrigloaderminerpersistence

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • LoaderBot executable

  • XMRig Miner payload

    miner

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2