General
-
Target
e589ca07439b86d88a5820b00535a1fac141bd022c904fff4b80c914d5d67862
-
Size
313KB
-
Sample
220620-qs46dafga9
-
MD5
8567240f275baaeb316c12f0cab580a6
-
SHA1
d2f07a8889c0e038d3b95dc434faa36b93114698
-
SHA256
e589ca07439b86d88a5820b00535a1fac141bd022c904fff4b80c914d5d67862
-
SHA512
b7daf73bb899dc5b27a0face5f6b02d918b13052e9b1e104243681e85023198adcfccca090a9ba77cf3d966ccb84f0b70400af4f1bd4474b9b126f39a00f0406
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
e589ca07439b86d88a5820b00535a1fac141bd022c904fff4b80c914d5d67862
-
Size
313KB
-
MD5
8567240f275baaeb316c12f0cab580a6
-
SHA1
d2f07a8889c0e038d3b95dc434faa36b93114698
-
SHA256
e589ca07439b86d88a5820b00535a1fac141bd022c904fff4b80c914d5d67862
-
SHA512
b7daf73bb899dc5b27a0face5f6b02d918b13052e9b1e104243681e85023198adcfccca090a9ba77cf3d966ccb84f0b70400af4f1bd4474b9b126f39a00f0406
-
XMRig Miner Payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-