Extracted

• • Target
    jaffacakes118_HEUR.Trojan.Win32.Generic.464055429d4b7d11932d65cba17e96c4
  • Size 1.6MB
  • SHA256 af0b46abfcf0601d7375f1885fa8b726f54c88968142371aee092aaf83c1aa19
  • MD5 464055429d4b7d11932d65cba17e96c4
  • SHA1 c8220e41f3e70d23747574ea014430eea6b457c6
  • SHA512 ef50d5b635eceb56694b3a7753527d15dd9123c395351b62c0cba43226c41b9846450e51aaf759ac2782f6c037e20dcea7be0365175da561c9ba0a7eb3d6d67c
  • SSDEEP 24576:a45MlL5YI2QmZEbLzgKDcGdeoAE479U/TKyeiOQ+iM/PvYh8Ds6qHMmOemypXq:PMaI2QmZE35ob78SV7imPgh8YZHMmmK
  • TLSH
    T13175336F1147BA62D76AC0B79ED22D09EB1D3D383BB63B655914F9C826F0360836136C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionloaderbotloaderminerpersistenceprivilege_escalation

  • Family: LoaderBot

    LoaderBot is a loader written in .NET downloading and executing miners.

    loaderminerloaderbot

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • LoaderBot executable

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Adds Run key to start application

    persistence
  behavioral1behavioral2