General
-
Target
file.exe
-
Size
351KB
-
Sample
230417-c5v7cacg74
-
MD5
5d2d9772ede423e38610247a6b1ceaef
-
SHA1
05a7d5e88b7d76c3bac82863e0ecdeee3c7062b8
-
SHA256
354b9ec827fa56fd50c0193ae8a49cd5de791012a94603efde7322a79a1e4173
-
SHA512
5aa2741e5ecd9f287274e7011dde190c30a7037fca69e1094a550a82fadb9ceac9728eb7ac9d47431aeb7cd0b56eacdc5ef8b39dcd451352169b1a346709c64a
-
SSDEEP
6144:BdBva6fLfwWbJQtkLzq7rPjmAdFAZb4N2:Bd9/DfwWbJ9LqP6AdF4
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
file.exe
-
Size
351KB
-
MD5
5d2d9772ede423e38610247a6b1ceaef
-
SHA1
05a7d5e88b7d76c3bac82863e0ecdeee3c7062b8
-
SHA256
354b9ec827fa56fd50c0193ae8a49cd5de791012a94603efde7322a79a1e4173
-
SHA512
5aa2741e5ecd9f287274e7011dde190c30a7037fca69e1094a550a82fadb9ceac9728eb7ac9d47431aeb7cd0b56eacdc5ef8b39dcd451352169b1a346709c64a
-
SSDEEP
6144:BdBva6fLfwWbJQtkLzq7rPjmAdFAZb4N2:Bd9/DfwWbJ9LqP6AdF4
-
XMRig Miner payload
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-