Extracted

• • Target

    9a4c96b227213b7049f851572487d42c994220bbf584f631bf347a507b684c1a.exe

  • Size

    4.8MB

  • MD5

    1fecbc51b5620e578c48a12ebeb19bc2

  • SHA1

    94fe551f4fb3ff76a0be99a962dc20fc2656453e

  • SHA256

    9a4c96b227213b7049f851572487d42c994220bbf584f631bf347a507b684c1a

  • SHA512

    ede6f39946562e253fcafe225292db32ba30f9476557304ae1769830e3a46c660920c304ca42d52544411e41acfc1bf206c829c98d61948cb595b1fa0105e2d7

  • SSDEEP

    98304:6qwWqwfM8jZlts7Dnfg+u5NIg1GbnBH9Ltl4NFA0kA8X1KpWQMg:6qwWqw0v7DnZu5NnobnDtl4TjZ8X1/Qf

  Score

  10^/10

  loaderbotxmrigloaderminerpersistence

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detects executables built or packed with MPress PE compressor

  • LoaderBot executable

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2