General
-
Target
file
-
Size
299KB
-
Sample
230207-agyw8age84
-
MD5
45745cc2b7e41ad2e663e73112e1d4eb
-
SHA1
27a58c48caedeb235a046e8657c9f05df829a585
-
SHA256
03b961537434ed16b110e1187856d6fd83887488126e6f36627beff091b1eb72
-
SHA512
d40f981d7d7bdb8f60db4746f27cb7d4639b181f98e7c1664a8d8c37af95353491bb80a7c75557379e9138256e2398ac90b5e48d02665f11024b54a7d471f805
-
SSDEEP
6144:C/SlLSuD8yVmbWuM3XPbRO0uQj9JKO48a:CKlG/ykipXI0ljK8
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20221111-en
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Targets
-
-
Target
file
-
Size
299KB
-
MD5
45745cc2b7e41ad2e663e73112e1d4eb
-
SHA1
27a58c48caedeb235a046e8657c9f05df829a585
-
SHA256
03b961537434ed16b110e1187856d6fd83887488126e6f36627beff091b1eb72
-
SHA512
d40f981d7d7bdb8f60db4746f27cb7d4639b181f98e7c1664a8d8c37af95353491bb80a7c75557379e9138256e2398ac90b5e48d02665f11024b54a7d471f805
-
SSDEEP
6144:C/SlLSuD8yVmbWuM3XPbRO0uQj9JKO48a:CKlG/ykipXI0ljK8
-
XMRig Miner payload
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-