General
- Target JaffaCakes118_76405f0aba384688fddaf31a294f88b8
- Size 5.1MB
- Sample250107-ymnv7sxqgn
- SHA256 db49ee22aaa915add5f012d2070d32ea2e50c2df78689754903a27430f22bf08
Score
10/10
Malware Config
Targets
-
- Target JaffaCakes118_76405f0aba384688fddaf31a294f88b8
- Size 5.1MB
- SHA256 db49ee22aaa915add5f012d2070d32ea2e50c2df78689754903a27430f22bf08
Score10/10LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
Loaderbot family
Xmrig family
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Identifies VirtualBox via ACPI registry values (likely anti-VM)
LoaderBot executable
XMRig Miner payload
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops startup file
Executes dropped EXE
Loads dropped DLL
Themida packer
Detects Themida, an advanced Windows software protection system.
Adds Run key to start application
Checks whether UAC is enabled
Legitimate hosting services abused for malware hosting/C2
Suspicious use of NtSetInformationThreadHideFromDebugger