Extracted

Extracted

• • Target

    JaffaCakes118_c884991c01d2854cd2d9b46f792207fc

  • Size

    7.3MB

  • MD5

    c884991c01d2854cd2d9b46f792207fc

  • SHA1

    3f1549e8aaea2119361caa588d47de42aab0dc47

  • SHA256

    914644da1b2f5c041a3199411b353f3c8e5b7e965399ac015bbc6c5286da7a7e

  • SHA512

    0fade5bc588ea78f9dc589ca2c1223ae6141e6eae3af92a7d660f5343ebfb798b6de1c6011f52061ef2a2cc29800615420dbaaa68b7fac3f10b6a0a0a6da9669

  • SSDEEP

    196608:9dm5Fdkyzf/xH8YRE4iQOr3asgZ9QHfz1afuVClmlB:9gPuybp5E4zO9Rc5ly

  Score

  10^/10

  loaderbotredlinexmrig@zenvolorddiscoveryinfostealerloaderminerpersistence

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • Loaderbot family

    loaderbot

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Redline family

    redline

  • XMRig Miner payload

    miner

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • LoaderBot executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • Suspicious use of SetThreadContext

  behavioral1behavioral2