General
-
Target
file.exe
-
Size
298KB
-
Sample
230515-fah53sha81
-
MD5
98b872988fa30b5ba4d24a280b632d8a
-
SHA1
efeb96fab9b2e9160b9944cefe1062fc714a5ffa
-
SHA256
1890d57705b8ac4dc77408a7cc539762f7350a590a688769cb9eca5a8618b361
-
SHA512
05e80f8bef6fc60ab034011593ab106a6fa77c7d21d27515e92ea8423dd9ae86c5057b4d95beea63f0ac8875fad2037dd147a3d12fa35dbf97c85dc1f9a6e256
-
SSDEEP
6144:bUuMIPLZ4aqf5BvHIIv+/3GQ2eRcsBtcq:bU7IPl4aaBHZ+/3GQnzBt
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
Malware Config
Extracted
tofsee
vanaheim.cn
jotunheim.name
Targets
-
-
Target
file.exe
-
Size
298KB
-
MD5
98b872988fa30b5ba4d24a280b632d8a
-
SHA1
efeb96fab9b2e9160b9944cefe1062fc714a5ffa
-
SHA256
1890d57705b8ac4dc77408a7cc539762f7350a590a688769cb9eca5a8618b361
-
SHA512
05e80f8bef6fc60ab034011593ab106a6fa77c7d21d27515e92ea8423dd9ae86c5057b4d95beea63f0ac8875fad2037dd147a3d12fa35dbf97c85dc1f9a6e256
-
SSDEEP
6144:bUuMIPLZ4aqf5BvHIIv+/3GQ2eRcsBtcq:bU7IPl4aaBHZ+/3GQnzBt
-
XMRig Miner payload
-
Creates new service(s)
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-