General
-
Target
9ffbf1dee1342b5247d97e56a9d6ba3772a96f192c01df816393850e1cd10583
-
Size
258KB
-
Sample
220614-bh8y9abebq
-
MD5
2dfa8a88958f9cfa18cb4f8943694d32
-
SHA1
ef3144be40be7f6f11180a7ae8bfc76ae06d9285
-
SHA256
9ffbf1dee1342b5247d97e56a9d6ba3772a96f192c01df816393850e1cd10583
-
SHA512
a6a40c5577558468bfd84967e91f1e5af92777c228eb27fa422b9d3826577f009645f7e4eb0944ca4205b8da44482ee89ee2e49e32a7a5982c5eece4976d3925
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
9ffbf1dee1342b5247d97e56a9d6ba3772a96f192c01df816393850e1cd10583
-
Size
258KB
-
MD5
2dfa8a88958f9cfa18cb4f8943694d32
-
SHA1
ef3144be40be7f6f11180a7ae8bfc76ae06d9285
-
SHA256
9ffbf1dee1342b5247d97e56a9d6ba3772a96f192c01df816393850e1cd10583
-
SHA512
a6a40c5577558468bfd84967e91f1e5af92777c228eb27fa422b9d3826577f009645f7e4eb0944ca4205b8da44482ee89ee2e49e32a7a5982c5eece4976d3925
-
XMRig Miner Payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-