Extracted

• • Target

    512415531e7f3ef14143d8ebb3c9fd804bb3a33dd907ac676364c6fabdf99871

  • Size

    448KB

  • MD5

    0d96da9c38b21d97fce1528e7dc1af7c

  • SHA1

    1b9b049440b495a9378df502686341734ff167b9

  • SHA256

    512415531e7f3ef14143d8ebb3c9fd804bb3a33dd907ac676364c6fabdf99871

  • SHA512

    d0511c6dee7001ec9e6f5de471d57870536f9e14a943cbb9ffab4df5252b27625ccad59904a2870767410082d6fb4e804169ebf523e4b1e0334b6ff065c2811a

  • SSDEEP

    12288:5i3Q+jkZaZJEeDoS/8+tR7HFVaX4zqhfkH:5i3Q+jkkDoS/8+tNvzAu

  Score

  10^/10

  loaderbotxmrigdiscoveryloaderminerpersistence

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Creates a large amount of network flows

    This may indicate a network scan to discover remotely running services.

    discovery

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2