General
-
Target
635c96eadf804c9514fa3c4cc93f08ccf658e32d331d7646fd1d2a2a8f80dc09
-
Size
235KB
-
Sample
211210-w66t1shde7
-
MD5
84b6df0a9ab6a18d4810ca534b17d7cc
-
SHA1
cf534454d4527e792dedc6a59aa4c16b2f454c7f
-
SHA256
635c96eadf804c9514fa3c4cc93f08ccf658e32d331d7646fd1d2a2a8f80dc09
-
SHA512
570f1e03f358bd26e634eca6539cc12fc0bad75b15448f256d16c4b55bd7677cdaa02c77afd9de4e18db9fd14384ba6f41d0b61f251c098f0725c2f3d49d3c56
Static task
static1
Malware Config
Extracted
tofsee
mubrikych.top
oxxyfix.xyz
Targets
-
-
Target
635c96eadf804c9514fa3c4cc93f08ccf658e32d331d7646fd1d2a2a8f80dc09
-
Size
235KB
-
MD5
84b6df0a9ab6a18d4810ca534b17d7cc
-
SHA1
cf534454d4527e792dedc6a59aa4c16b2f454c7f
-
SHA256
635c96eadf804c9514fa3c4cc93f08ccf658e32d331d7646fd1d2a2a8f80dc09
-
SHA512
570f1e03f358bd26e634eca6539cc12fc0bad75b15448f256d16c4b55bd7677cdaa02c77afd9de4e18db9fd14384ba6f41d0b61f251c098f0725c2f3d49d3c56
-
XMRig Miner Payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Deletes itself
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-