loaderbot | 4d13c9ed600e109cf6540800f702eb28921b75c703a68e810bfea63d1989a81d | Triage

Submit
Reports

Overview

overview

Static

static

JaffaCakes...a2.exe

windows7-x64

JaffaCakes...a2.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_646543a3d52cc28ce2defb91eb3a0fa2
Size

4.3MB
Sample

250102-mfpy5szqgk
MD5

646543a3d52cc28ce2defb91eb3a0fa2
SHA1

1932da4ace59883328d589cde74f11c01c713b0a
SHA256

4d13c9ed600e109cf6540800f702eb28921b75c703a68e810bfea63d1989a81d
SHA512

14027b89dfa307533917ac8e4f7deb9f2b6eac021ae9ecef33781739a45779c6573d49b740bc788875b41f8ddd9c6bb883d24f71392eadaa2a91e58bf2f572ac
SSDEEP

98304:NNNaf55cH3Bj1JkxjOejrq8lVwOro1bbyOFb0hjB4+81TC:NNNa4HxDe/GDhFb0lB4+

Score

10^/10

loaderbot xmrig discovery loader miner persistence

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_646543a3d52cc28ce2defb91eb3a0fa2.exe

Resource

win7-20240903-en

loaderbot xmrig discovery loader miner persistence

windows7-x64

16 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_646543a3d52cc28ce2defb91eb3a0fa2.exe

Resource

win10v2004-20241007-en

loaderbot xmrig discovery loader miner persistence

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_646543a3d52cc28ce2defb91eb3a0fa2
- Size
  
  4.3MB
- MD5
  
  646543a3d52cc28ce2defb91eb3a0fa2
- SHA1
  
  1932da4ace59883328d589cde74f11c01c713b0a
- SHA256
  
  4d13c9ed600e109cf6540800f702eb28921b75c703a68e810bfea63d1989a81d
- SHA512
  
  14027b89dfa307533917ac8e4f7deb9f2b6eac021ae9ecef33781739a45779c6573d49b740bc788875b41f8ddd9c6bb883d24f71392eadaa2a91e58bf2f572ac
- SSDEEP
  
  98304:NNNaf55cH3Bj1JkxjOejrq8lVwOro1bbyOFb0hjB4+81TC:NNNa4HxDe/GDhFb0lB4+
Score

10^/10

loaderbot xmrig discovery loader miner persistence
- LoaderBot
  LoaderBot is a loader written in .NET downloading and executing miners.
  loader miner loaderbot
- Loaderbot family
  loaderbot
- Xmrig family
  xmrig
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- LoaderBot executable
- XMRig Miner payload
  miner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

loaderbotxmrigdiscoveryloaderminerpersistence

behavioral2

loaderbotxmrigdiscoveryloaderminerpersistence

© 2018-2025

Terms | Privacy