General
-
Target
121d987ced0e68d9502967d49ff20c6d08fe2fa261f9eca10a0fa9e8c174681d
-
Size
265KB
-
Sample
220605-3fhstsheem
-
MD5
adaa7b07770c753d69eda0b502f785e0
-
SHA1
97bfa6a1dea44cddac9ad9d7a8f0e7381071109d
-
SHA256
121d987ced0e68d9502967d49ff20c6d08fe2fa261f9eca10a0fa9e8c174681d
-
SHA512
cf2b16cda60571ee46fad10932b3726bb4cc7e6962da7228bde74ac2a52025a86cd87b361b362b0568c8a70aed3f6b4eb978440a816daab7bd596d0ece90c2bc
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
121d987ced0e68d9502967d49ff20c6d08fe2fa261f9eca10a0fa9e8c174681d
-
Size
265KB
-
MD5
adaa7b07770c753d69eda0b502f785e0
-
SHA1
97bfa6a1dea44cddac9ad9d7a8f0e7381071109d
-
SHA256
121d987ced0e68d9502967d49ff20c6d08fe2fa261f9eca10a0fa9e8c174681d
-
SHA512
cf2b16cda60571ee46fad10932b3726bb4cc7e6962da7228bde74ac2a52025a86cd87b361b362b0568c8a70aed3f6b4eb978440a816daab7bd596d0ece90c2bc
-
XMRig Miner Payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-