General
-
Target
4851afa56300c12fa2b7b53433ea00ec02697bd0e2357380e302aad1c50f1ce0
-
Size
218KB
-
Sample
220612-tf3nkafbgj
-
MD5
257af79d81f84005c6e5d914bae32a39
-
SHA1
3c01831b94342221331727a691b59889efedb115
-
SHA256
4851afa56300c12fa2b7b53433ea00ec02697bd0e2357380e302aad1c50f1ce0
-
SHA512
b0c555a2de9fed9e07238d92ead80ace797618f045b68744879e82bd239072aef90522636cf3af55cff28da5c6a493043948ce2e7248ec608647793c8654515d
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
4851afa56300c12fa2b7b53433ea00ec02697bd0e2357380e302aad1c50f1ce0
-
Size
218KB
-
MD5
257af79d81f84005c6e5d914bae32a39
-
SHA1
3c01831b94342221331727a691b59889efedb115
-
SHA256
4851afa56300c12fa2b7b53433ea00ec02697bd0e2357380e302aad1c50f1ce0
-
SHA512
b0c555a2de9fed9e07238d92ead80ace797618f045b68744879e82bd239072aef90522636cf3af55cff28da5c6a493043948ce2e7248ec608647793c8654515d
-
XMRig Miner Payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Deletes itself
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-