General
-
Target
084ab9d554c19de78a8e5097b064cb06c20758474be10843f125008b1f46c3ec
-
Size
196KB
-
Sample
220924-z4js9acae7
-
MD5
0e45d8d6ed356ff2fb1e8c717eaf9deb
-
SHA1
4b1336c5d1dd20d1fb8a024b3cfeb241070cbef5
-
SHA256
084ab9d554c19de78a8e5097b064cb06c20758474be10843f125008b1f46c3ec
-
SHA512
7f8703806b82c27f7f95b241f74a9201ca9444e32becb4e29a5ac37bf4cd2abab2768aa9f5063ef98888acb9506483ea9d03c2be8c3d4ef6a3484c1d67ef9489
-
SSDEEP
3072:jt5B/L3gsZl3N5D/M+NQnHkZaTc+BinMCr/PkkXx:hLrZlTFQnEOw
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
084ab9d554c19de78a8e5097b064cb06c20758474be10843f125008b1f46c3ec
-
Size
196KB
-
MD5
0e45d8d6ed356ff2fb1e8c717eaf9deb
-
SHA1
4b1336c5d1dd20d1fb8a024b3cfeb241070cbef5
-
SHA256
084ab9d554c19de78a8e5097b064cb06c20758474be10843f125008b1f46c3ec
-
SHA512
7f8703806b82c27f7f95b241f74a9201ca9444e32becb4e29a5ac37bf4cd2abab2768aa9f5063ef98888acb9506483ea9d03c2be8c3d4ef6a3484c1d67ef9489
-
SSDEEP
3072:jt5B/L3gsZl3N5D/M+NQnHkZaTc+BinMCr/PkkXx:hLrZlTFQnEOw
-
XMRig Miner payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Deletes itself
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-