Extracted

• • Target

    707ba8dca9b7d9c717d33e102cd80cae

  • Size

    4.3MB

  • MD5

    707ba8dca9b7d9c717d33e102cd80cae

  • SHA1

    cf6edd3ae5df41a07c6df335836a292028739b98

  • SHA256

    25f1d3238d50fcbe2c26b743197e2ae319bf61fc927ca5e5cf3c009ba35512d9

  • SHA512

    945c3481c7388e814210a5d1fa42cbb5c9e8833f30c3089991f309171c563f1d036b0bb8cf067d28862747179334be5c283e4c8586a92c1ce2f82af498456b3f

  • SSDEEP

    98304:kNNaf55cH3Bj1JkxjOejrq8lVwOro1bbyOFb0hjB4+81TC:kNNa4HxDe/GDhFb0lB4+

  Score

  10^/10

  loaderbotxmrigloaderminerpersistence

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • LoaderBot executable

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2