General
-
Target
f20fead7bf2edbf5575421bda55a7999e329e6c997c84f4429f700d74773b986
-
Size
265KB
-
Sample
220605-1chybahbdr
-
MD5
ba4e843255dd4005041543477dd85ed3
-
SHA1
bd722d3e8c53264aaacb12dda0df418491fa3945
-
SHA256
f20fead7bf2edbf5575421bda55a7999e329e6c997c84f4429f700d74773b986
-
SHA512
ec1919b114b771e9aa58cee0551abab7f9ad37027e472d5da5849367780462bd5419625a0a68855fe05cb803d9df3bc854c90e013f951c27436fe512dd603732
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
f20fead7bf2edbf5575421bda55a7999e329e6c997c84f4429f700d74773b986
-
Size
265KB
-
MD5
ba4e843255dd4005041543477dd85ed3
-
SHA1
bd722d3e8c53264aaacb12dda0df418491fa3945
-
SHA256
f20fead7bf2edbf5575421bda55a7999e329e6c997c84f4429f700d74773b986
-
SHA512
ec1919b114b771e9aa58cee0551abab7f9ad37027e472d5da5849367780462bd5419625a0a68855fe05cb803d9df3bc854c90e013f951c27436fe512dd603732
-
XMRig Miner Payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-