General
-
Target
b193d4f9f35b39149918d528814f676d5c73e84c4130501d1344704c67790f66
-
Size
184KB
-
Sample
220613-hh4g4aadf6
-
MD5
33c10060c162d52718f99f01e5ad52cb
-
SHA1
951590ae3d8de9f66408aa05074f0920c09a40ae
-
SHA256
b193d4f9f35b39149918d528814f676d5c73e84c4130501d1344704c67790f66
-
SHA512
97be08b7705b02a3933d29f2ed976afe91850cca41aae4408495b36f2319af3138dc8dbf29fc4837ba73053c9f28289a6c46e823211a703143ce0a101859be3c
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
b193d4f9f35b39149918d528814f676d5c73e84c4130501d1344704c67790f66
-
Size
184KB
-
MD5
33c10060c162d52718f99f01e5ad52cb
-
SHA1
951590ae3d8de9f66408aa05074f0920c09a40ae
-
SHA256
b193d4f9f35b39149918d528814f676d5c73e84c4130501d1344704c67790f66
-
SHA512
97be08b7705b02a3933d29f2ed976afe91850cca41aae4408495b36f2319af3138dc8dbf29fc4837ba73053c9f28289a6c46e823211a703143ce0a101859be3c
-
XMRig Miner Payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-