Extracted

• • Target
    2026-03-07_2342aaad6db3080f2cdf541f39d98de0_amadey_elex_luca-stealer_lynx_njrat_stealc
  • Size 15.8MB
  • SHA256 f9241855121b9608729ba7eb48e2465834f0164c6213a9371dbced969f7b318b
  • MD5 2342aaad6db3080f2cdf541f39d98de0
  • SHA1 9d1a2a6818be16f7d60961398737ff2bc163efb8
  • SHA512 0765681b2ee3cd8a45623b27ed5b77036e405f08ee9d009f337834bd9af05abb46b2a17b91ecdcb8106c0f90ffe3f9105e07fddc8e988d8a2b3fc62d450fb8fe
  • SSDEEP 98304:ybFXaexwoV2rqKxaWkidqVtIhjAgWlZHrtjFsN3RwC+cDhfXXWB:gwexwoVLhidqVtg8jZHrw3wC+8
  • TLSH
    T1C5F63983A2930455E14AB370B54D01D59781EEA205E4BBBFA8F2FE683FA41441FF3A57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryloaderbotxmrigloaderminerpersistence

  • LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • Loaderbot family

    loaderbot

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Detects executables built or packed with MPress PE compressor

  • LoaderBot executable

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2