General
-
Target
file.exe
-
Size
321KB
-
Sample
230206-vjh9rsac2y
-
MD5
2a6d0dc80d852b76efe1488a0c4a38a6
-
SHA1
5d22dca827854c071ac3387090d912648541c470
-
SHA256
b2d8e0f8c89c4170394d3485ccab572e85704d7596e15f6cff784bf91ddeac1b
-
SHA512
2e79b6c927582ddf3fb8a7e5b01a58177eb8f6732f2f16695b889ab557234687db9781f5d7f506937312c9466152b4794c1262578180fd53cdb14bb663a1ac21
-
SSDEEP
3072:uB0fS/L4QgpR60YNPml6u0sYcRvIUX82QMycCKEuQjiMTE53516ag75:iRLrgS0YglyZ29ycCKEuQj9C516aM5
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
file.exe
-
Size
321KB
-
MD5
2a6d0dc80d852b76efe1488a0c4a38a6
-
SHA1
5d22dca827854c071ac3387090d912648541c470
-
SHA256
b2d8e0f8c89c4170394d3485ccab572e85704d7596e15f6cff784bf91ddeac1b
-
SHA512
2e79b6c927582ddf3fb8a7e5b01a58177eb8f6732f2f16695b889ab557234687db9781f5d7f506937312c9466152b4794c1262578180fd53cdb14bb663a1ac21
-
SSDEEP
3072:uB0fS/L4QgpR60YNPml6u0sYcRvIUX82QMycCKEuQjiMTE53516ag75:iRLrgS0YglyZ29ycCKEuQj9C516aM5
-
XMRig Miner payload
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-