General
-
Target
file.exe
-
Size
259KB
-
Sample
230327-j29nwscd78
-
MD5
0ba4447a07a7c2c63cfe7aa69173ab6a
-
SHA1
00273726672ded3869e15e24e09ee1053f547f0f
-
SHA256
7c3bd96cd755ebe1e700c2b578cf83e88d10ce2529213c5bccf2def62b5a6474
-
SHA512
0b169df73780dfe8d3e5b4c1c298e51e2cab756482a6f6cb439ddae6e66f4c918daa8aa3f059820b2639651e59bc766dc506df654d218d995e843b5f343ebd4d
-
SSDEEP
3072:cypgerGfQDgLG96SFeQYWxK14YrLLKzxR/yrhIfD1lBqlb2PDFgvRs5xbBo2+:1xDgLzSHYKg4Yr0bTlm6Zto
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
file.exe
-
Size
259KB
-
MD5
0ba4447a07a7c2c63cfe7aa69173ab6a
-
SHA1
00273726672ded3869e15e24e09ee1053f547f0f
-
SHA256
7c3bd96cd755ebe1e700c2b578cf83e88d10ce2529213c5bccf2def62b5a6474
-
SHA512
0b169df73780dfe8d3e5b4c1c298e51e2cab756482a6f6cb439ddae6e66f4c918daa8aa3f059820b2639651e59bc766dc506df654d218d995e843b5f343ebd4d
-
SSDEEP
3072:cypgerGfQDgLG96SFeQYWxK14YrLLKzxR/yrhIfD1lBqlb2PDFgvRs5xbBo2+:1xDgLzSHYKg4Yr0bTlm6Zto
-
XMRig Miner payload
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-