General
-
Target
1d8b78fcbb6f3e68c24f759b86c7cea38f5b5642a9d2c556cc9c35a7ee24b8d4
-
Size
262KB
-
Sample
220606-mngbzabgcl
-
MD5
57efeee8a462cb7aad1342613a7afb96
-
SHA1
3fafa99c551edd87e9faadefc600f324c8203542
-
SHA256
1d8b78fcbb6f3e68c24f759b86c7cea38f5b5642a9d2c556cc9c35a7ee24b8d4
-
SHA512
1cfb3ef43304a6bd4368eb875e7a50ed88b0cd60ad477a95197f9be7bfe32930c1e1d3cd15a8e7793c6c594727e521c4d96d4fd1097733410400a8f100c4daf1
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
1d8b78fcbb6f3e68c24f759b86c7cea38f5b5642a9d2c556cc9c35a7ee24b8d4
-
Size
262KB
-
MD5
57efeee8a462cb7aad1342613a7afb96
-
SHA1
3fafa99c551edd87e9faadefc600f324c8203542
-
SHA256
1d8b78fcbb6f3e68c24f759b86c7cea38f5b5642a9d2c556cc9c35a7ee24b8d4
-
SHA512
1cfb3ef43304a6bd4368eb875e7a50ed88b0cd60ad477a95197f9be7bfe32930c1e1d3cd15a8e7793c6c594727e521c4d96d4fd1097733410400a8f100c4daf1
-
XMRig Miner Payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-