Extracted

• • Target
    JaffaCakes118_2c5b777d32eb0ab76804e42db1318dbd
  • Size 1.3MB
  • SHA256 2eb0bae173c8d79bc9180db259f08700ace9992e23c8560c89d28e0080c4bcba
  • MD5 2c5b777d32eb0ab76804e42db1318dbd
  • SHA1 f753f0e94ca4eaf10560285b67f44b23ae909dee
  • SHA512 ce21df1d4b5ea30ed9a66a3b25d87589c8642650f3bef116d563251a848964a2e5ebe249525311ed609ac285f29d51321eec9572b025d9fbf4e8e2fdb6631ff6
  • SSDEEP 24576:0yltNAMKAv9qTXUTh39YSLgAvS7rJhM09qUsj3QHnjgiRjf0bg1tDvhTe0E/dJZl:0G+E93S667NhM5gRRjf/1llElJZAIZg4
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoveryexecutionloaderbotloaderminerpersistence

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • Loaderbot family

    loaderbot

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • LoaderBot executable

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1
• • Target
    $1/1337/NetFramework.exe
  • Size 1.3MB
  • SHA256 0cc41dcf71bae5911647af1d05b61c118f4acb6d3aec8113a311c02c3ddf1082
  • MD5 6c986a80c8bbb19a08ead0758f23ccf7
  • SHA1 10b3fd235f0b55db3cb6f8c77c2fc846c24f8c4c
  • SHA512 29d0a01a194c10e423df0f53cdcf2273d9b22d2ffeb1d553efc1e8587d86666175d4ebee1310c711757e2fab554850def9944809c9e5d932f059492efd70df08
  • SSDEEP 24576:E/HBQ5M9JOfpZ3eNS/mLB/+WXCbpYc3/Ze781ZlJb8vAS5utIQrvi:E/Bd6Z3PcG04pjV1jJLS5uZrv
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  defense_evasiondiscoveryexecutionloaderbotloaderminerpersistence

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • Loaderbot family

    loaderbot

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • LoaderBot executable

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Adds Run key to start application

    persistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral2
• • Target
    $1/1337/NetFrameworkUpdate.bat
  • Size 171B
  • SHA256 6d507be4e1177b290902a9461fb84cae32b38d2cb6ae1366143b4cb23e984190
  • MD5 575e8a69a9906efc0da5ce5edc1609d5
  • SHA1 85afcde175f06224baad88f92f29b73195e84b04
  • SHA512 a9b32569482ea5b2cc4e146d4a7651e7854c78cf1843d07fe6f8e1de759ec3629fb26d7cebf8edf8a1f452380f73050ead6019dba56103fbd617145fb31d95b0
  • MD5 SHA1 SHA512

  Score

  3^/10

  defense_evasion
  behavioral3
• • Target
    $PLUGINSDIR/System.dll
  • Size 11KB
  • SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
  • MD5 2ae993a2ffec0c137eb51c8832691bcb
  • SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
  • SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
  • SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
  • MD5 SHA1 SHA512 SSDEEP

  Score

  3^/10

  discovery
  behavioral4