loaderbot | W1nnerFree CS2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
W1nnerFree CS2.exe
Size 21.4MB
Sample240219-ljsnrsca98
SHA256 0fa48a6368effe6c9373dd34f9f26bf7f0a2050aab330cefc5acc6de5030ecb6
MD5 7494cccce30350832ac77113f3cf28d8
SHA1 ffba86775e5dc0a12957249e5f2d1c48bb1c58f0
SHA512 94550c34c2887ca3227bfc559eeb2806bdd189b31bd866facbc5ed22ff2f6dc89684b268aa22a36c1b6a062deb2db6545d4e1b021a572f85fc9fcf7f65d059e7
SSDEEP 393216:KYd9oOoUptPemm5HCizqg+o1sg1t6u14FBmqXiW2wcpIZSFH+fbYdUvCAhZ:pdnh/Ge41L1th15qIT41fsdU6m
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loaderbot

Malware Config

Signatures

LoaderBot executable 1 IoCs

resource	yara_rule
static1/unpack001/$1/1337/MinerMega.exe	loaderbot

Loaderbot family
loaderbot

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
W1nnerFree CS2.exe
unpack001/$1/1337/ExLoader_Installer.exe
unpack001/$1/1337/MinerMega.exe
unpack001/$PLUGINSDIR/System.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

W1nnerFree CS2.exe

.exe 21.4MB
$1/1337/ExLoader_Installer.exe

.exe 19.8MB
$1/1337/MinerMega.exe

.exe 4.0MB
$PLUGINSDIR/System.dll

.dll 11KB

W1nnerFree CS2.exe

IMPHASH 4f67aeda01a0484282e8c59006b0b352
SHA256 0fa48a6368effe6c9373dd34f9f26bf7f0a2050aab330cefc5acc6de5030ecb6
MD5 7494cccce30350832ac77113f3cf28d8
SHA1 ffba86775e5dc0a12957249e5f2d1c48bb1c58f0
SHA512 94550c34c2887ca3227bfc559eeb2806bdd189b31bd866facbc5ed22ff2f6dc89684b268aa22a36c1b6a062deb2db6545d4e1b021a572f85fc9fcf7f65d059e7
SSDEEP 393216:KYd9oOoUptPemm5HCizqg+o1sg1t6u14FBmqXiW2wcpIZSFH+fbYdUvCAhZ:pdnh/Ge41L1th15qIT41fsdU6m
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12843

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA ReadFile GetFileAttributesA SetFileAttributesA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion GetCurrentProcess GetFullPathNameA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA lstrcpynA SetErrorMode GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$1/1337/ExLoader_Installer.exe

IMPHASH 9d6872d1f450876f7f0d8dc687f29c79
SHA256 f1e92828ebf9e2443f36c03a5a66a4fba4bd8744ecf5bbf59fc69c84d7a95d18
MD5 afcb0e5c7c35c05970a74a1aab5fe12e
SHA1 42eacb7a9594ee0a6242d3bc3c33b6c60b3fc319
SHA512 fe62d4b1ec93a21a7b1f80e5f42b17c0c43d794b99e7e87fb6fea86d82ac080d76dcf9a3e96516303ccaf88b8101523a23f5b7f560bd3f4bb2745ac1f71b4dfb
SSDEEP 393216:QuTOvTuAnHmMgEMSb6qLdTcmtgt+BDMncawXAKaVnayxZtFDtq:dUTPGMzpbpT8+BInf46VnvHrJq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

52864

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb

comctl32

ord17

kernel32

DeleteFileA DeleteFileW CreateDirectoryA CreateDirectoryW FindClose FindNextFileA FindFirstFileA FindNextFileW FindFirstFileW GetTickCount WideCharToMultiByte MultiByteToWideChar GetVersionExA GlobalAlloc lstrlenA GetModuleFileNameA FindResourceA GetModuleHandleA HeapAlloc GetProcessHeap HeapFree HeapReAlloc CompareStringA ExitProcess GetLocaleInfoA GetNumberFormatA GetProcAddress DosDateTimeToFileTime GetDateFormatA GetTimeFormatA FileTimeToSystemTime FileTimeToLocalFileTime ExpandEnvironmentStringsA WaitForSingleObject SetCurrentDirectoryA Sleep GetTempPathA MoveFileExA GetModuleFileNameW SetEnvironmentVariableA GetCommandLineA LocalFileTimeToFileTime SystemTimeToFileTime GetSystemTime IsDBCSLeadByte GetCPInfo FreeLibrary LoadLibraryA GetCurrentDirectoryA GetFullPathNameA SetFileAttributesW SetFileAttributesA GetFileAttributesW GetFileAttributesA WriteFile GetStdHandle ReadFile CreateFileW SetLastError CreateFileA GetFileType SetEndOfFile SetFilePointer MoveFileA SetFileTime GetCurrentProcess CloseHandle GetLastError lstrcmpiA

user32

FindWindowExA GetClassNameA ReleaseDC GetDC SendMessageA wsprintfA SetDlgItemTextA EndDialog DestroyIcon SendDlgItemMessageA GetDlgItemTextA DialogBoxParamA IsWindowVisible WaitForInputIdle GetSysColor PostMessageA SetMenu SetFocus LoadBitmapA LoadIconA CharToOemA OemToCharA wvsprintfA SetWindowLongA CharUpperA GetWindowRect GetParent MapWindowPoints CreateWindowExA UpdateWindow SetWindowTextA LoadCursorA RegisterClassExA SetWindowLongPtrA GetWindowLongPtrA DefWindowProcA PeekMessageA TranslateMessage DispatchMessageA DestroyWindow GetClientRect CopyRect IsWindow MessageBoxA ShowWindow GetDlgItem EnableWindow CharToOemBuffA LoadStringA SetWindowPos GetWindowTextA GetSystemMetrics GetWindow GetWindowLongA OemToCharBuffA GetMessageA

gdi32

GetDeviceCaps GetObjectA CreateCompatibleBitmap SelectObject StretchBlt CreateCompatibleDC DeleteObject DeleteDC

comdlg32

GetOpenFileNameA CommDlgExtendedError GetSaveFileNameA

advapi32

LookupPrivilegeValueA RegOpenKeyExA RegQueryValueExA RegCreateKeyExA RegSetValueExA RegCloseKey SetFileSecurityW SetFileSecurityA OpenProcessToken AdjustTokenPrivileges

shell32

ShellExecuteExA SHFileOperationA SHGetFileInfoA SHGetSpecialFolderLocation SHGetMalloc SHBrowseForFolderA SHGetPathFromIDListA SHChangeNotify

ole32

CreateStreamOnHGlobal OleInitialize CoCreateInstance OleUninitialize CLSIDFromString

oleaut32

VariantInit

$1/1337/MinerMega.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 5817eb190e2adfb6b1a8488df5e83cda619969a4ea5cccca282a348ef35d09ad
MD5 d1f8ccf271359d1d1840075b3065cdaa
SHA1 5b316201fb5d9705e20398ded7d0441962e2b183
SHA512 5fb53f967b940f76b9c98d09773bea69c6ccbfd2469b9eb64868042f2ee56860d8a000b469ce941a2241adbe261ace43273c9a6cef9821ff6eabeb8f63b81e07
SSDEEP 49152:ENDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:SzP88fBsnZTgOtqB3m1RC3
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

LoaderBot executable
Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4162158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
MD5 2ae993a2ffec0c137eb51c8832691bcb
SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

W1nnerFree CS2.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$1/1337/ExLoader_Installer.exe

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

$1/1337/MinerMega.exe

mscoree

dotnet

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic