General
-
Target
cfddf92619885839b81bbbee57e59eafc0b2dd6a07074ebca1330a829005cac4
-
Size
262KB
-
Sample
220606-j8jq2seha7
-
MD5
17fe390989a63f4ad0d9ea1895076223
-
SHA1
ef903729438aa57f7c36f098c9c449bc0d2da1c7
-
SHA256
cfddf92619885839b81bbbee57e59eafc0b2dd6a07074ebca1330a829005cac4
-
SHA512
79b72d5bca272004bacfa10a845a85aeba2ec093d57e002a96c0fcc60469218457b06e2ab3e97e5ba49a5118e7a079172f26f59de83154c6e98d02a93e2dd226
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
cfddf92619885839b81bbbee57e59eafc0b2dd6a07074ebca1330a829005cac4
-
Size
262KB
-
MD5
17fe390989a63f4ad0d9ea1895076223
-
SHA1
ef903729438aa57f7c36f098c9c449bc0d2da1c7
-
SHA256
cfddf92619885839b81bbbee57e59eafc0b2dd6a07074ebca1330a829005cac4
-
SHA512
79b72d5bca272004bacfa10a845a85aeba2ec093d57e002a96c0fcc60469218457b06e2ab3e97e5ba49a5118e7a079172f26f59de83154c6e98d02a93e2dd226
-
XMRig Miner Payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-