Extracted

• • Target

    e3801874cc5d57f0f249ba6499d6c870e2a1ed6f695ada3389cbf19ed2c85d6e

  • Size

    2.9MB

  • MD5

    f1c1e000b7a5eed40ab8ee2c26762ee0

  • SHA1

    9b8ab465443188315937a634977d9540316fc844

  • SHA256

    e3801874cc5d57f0f249ba6499d6c870e2a1ed6f695ada3389cbf19ed2c85d6e

  • SHA512

    403b1a6bc21b3d06a21cfb970580a8b17e206882a0d2b2c851d9692ad4bf32ef45c61d99fd77b74e7436dc12620f1e0dd94c6a816ec566270f32913e37a30ac4

  • SSDEEP

    49152:/KeQYo/yWQx5Y0kh0AwS5T4Gh0P678H6FpuasPrEHMWC52YsnkSXTK0uvooNCul2:kz/8x5YgE5T4Z96Hu7Y+2lK0somCQ16d

  Score

  10^/10

  loaderbotxmrigdiscoveryloaderminerpersistence

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • LoaderBot executable

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2