Overview

overview

10

Static

static

3

NiggerDick.exe

windows7-x64

10

NiggerDick.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    NiggerDick.exe

  • Size

    3.6MB

  • Sample

    240726-n5mqrazdma

  • MD5

    edcd9b037986143a8bad4985bf0e661d

  • SHA1

    aa7ad22502f138c9ef68b6e66f50999ed94c7276

  • SHA256

    e65878b615947fcf75baee636c9a2012e28873beb43b8b0250bd9af4b11339ba

  • SHA512

    3f62163ae6bb81dc59e23c6ad5192de1fd0bfe7e6e85e4420119e314b48c7431bdd368c841f802c858aee67a45b88959ce32f961de9a8e965cc47cf7b946ea9c

  • SSDEEP

    49152:8F24+xNyKwdkMRcHwK5+MdqUolO+r8tEAmafrP4iUUYJETGXP6XA:8F24gNyKw6MpMdqpfrjgUi2ETGXM

Score
10/10
emotetprivateloaderxmrigbankerbootkitdiscoveryloaderminerpersistencetrojanvmprotect

Malware Config

Targets

    • Target

      NiggerDick.exe

    • Size

      3.6MB

    • MD5

      edcd9b037986143a8bad4985bf0e661d

    • SHA1

      aa7ad22502f138c9ef68b6e66f50999ed94c7276

    • SHA256

      e65878b615947fcf75baee636c9a2012e28873beb43b8b0250bd9af4b11339ba

    • SHA512

      3f62163ae6bb81dc59e23c6ad5192de1fd0bfe7e6e85e4420119e314b48c7431bdd368c841f802c858aee67a45b88959ce32f961de9a8e965cc47cf7b946ea9c

    • SSDEEP

      49152:8F24+xNyKwdkMRcHwK5+MdqUolO+r8tEAmafrP4iUUYJETGXP6XA:8F24gNyKw6MpMdqpfrjgUi2ETGXM

    Score
    10/10
    emotetprivateloaderxmrigbankerbootkitdiscoveryloaderminerpersistencetrojanvmprotect

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

      trojanbankeremotet

    • PrivateLoader

      PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

      loaderprivateloader

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks