General
-
Target
5494eb3e9916e9f0401ff9c32f223fd97187b93c182b81b054560e27ab339a37
-
Size
180KB
-
Sample
220604-nsv7csdgg6
-
MD5
06350bf2bfe5d6a8a3566f35abca4ef9
-
SHA1
245fc54afbe349fd4e69d01367771ea3316dc872
-
SHA256
5494eb3e9916e9f0401ff9c32f223fd97187b93c182b81b054560e27ab339a37
-
SHA512
e80edb30f626c35072e3027e3fd251ab2837ab15e1481d834cffc60327b7204fd9c15726c23cff915af044e87cb6afea10354e8bb1d253699b8e42af28645814
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
5494eb3e9916e9f0401ff9c32f223fd97187b93c182b81b054560e27ab339a37
-
Size
180KB
-
MD5
06350bf2bfe5d6a8a3566f35abca4ef9
-
SHA1
245fc54afbe349fd4e69d01367771ea3316dc872
-
SHA256
5494eb3e9916e9f0401ff9c32f223fd97187b93c182b81b054560e27ab339a37
-
SHA512
e80edb30f626c35072e3027e3fd251ab2837ab15e1481d834cffc60327b7204fd9c15726c23cff915af044e87cb6afea10354e8bb1d253699b8e42af28645814
-
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
-
XMRig Miner Payload
-
Creates new service(s)
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-