Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
8084ddbb05abf2b0b58da1df1651381d7faf40f7e11abacbaf3b4109a5c4c55f
-
Size
184KB
-
Sample
221201-lym2tsga37
-
MD5
ff27a95b8ff697b431c1d702f4f4a5b9
-
SHA1
b00db7aa00da096b1925c7ab201e0f594d6fe244
-
SHA256
8084ddbb05abf2b0b58da1df1651381d7faf40f7e11abacbaf3b4109a5c4c55f
-
SHA512
30a3d67c37d35c34d8f0e196d50b25124d8896370ebce0ecc21c5c5843d9dd114be5baf092f5dd9f12f3caed99942fcca1dbd1a45e7dddbc4031b4a60e25dee6
-
SSDEEP
3072:o+MTMVhkZdkwprC573PfJg/gzCvoUUfIKcJaOKRw+6/6gWmBo:pMFZdkwGg4zCOfIKcJaO+MSgW
Static task
static1
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
8084ddbb05abf2b0b58da1df1651381d7faf40f7e11abacbaf3b4109a5c4c55f
-
Size
184KB
-
MD5
ff27a95b8ff697b431c1d702f4f4a5b9
-
SHA1
b00db7aa00da096b1925c7ab201e0f594d6fe244
-
SHA256
8084ddbb05abf2b0b58da1df1651381d7faf40f7e11abacbaf3b4109a5c4c55f
-
SHA512
30a3d67c37d35c34d8f0e196d50b25124d8896370ebce0ecc21c5c5843d9dd114be5baf092f5dd9f12f3caed99942fcca1dbd1a45e7dddbc4031b4a60e25dee6
-
SSDEEP
3072:o+MTMVhkZdkwprC573PfJg/gzCvoUUfIKcJaOKRw+6/6gWmBo:pMFZdkwGg4zCOfIKcJaO+MSgW
-
XMRig Miner payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-