General
-
Target
1b3c77e63d8fec78ca14ebf56e3ba4a498c33b22a449e4ef4989ffb4687bc83f
-
Size
340KB
-
Sample
220810-q8ewesbacl
-
MD5
050031c5c0e09719f78a8f0409a57733
-
SHA1
4dc217019c978b620536b0b1db56a1e3013a807e
-
SHA256
1b3c77e63d8fec78ca14ebf56e3ba4a498c33b22a449e4ef4989ffb4687bc83f
-
SHA512
db160444bb27ce7544d1881f898f0104c680180173271dc66890538b0765bfe2c44fdafe38ee9b07bff871fcfecc457643d7c4b8034a157e177e49b65aa1d897
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
1b3c77e63d8fec78ca14ebf56e3ba4a498c33b22a449e4ef4989ffb4687bc83f
-
Size
340KB
-
MD5
050031c5c0e09719f78a8f0409a57733
-
SHA1
4dc217019c978b620536b0b1db56a1e3013a807e
-
SHA256
1b3c77e63d8fec78ca14ebf56e3ba4a498c33b22a449e4ef4989ffb4687bc83f
-
SHA512
db160444bb27ce7544d1881f898f0104c680180173271dc66890538b0765bfe2c44fdafe38ee9b07bff871fcfecc457643d7c4b8034a157e177e49b65aa1d897
-
XMRig Miner payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-