Overview

overview

10

Static

static

a3d4f3ddda...4d.exe

windows7_x64

10

a3d4f3ddda...4d.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a3d4f3ddda48e3ed9d7dff71122b7ad4dc970607634337848194fbf733c8244d

  • Size

    236KB

  • Sample

    210504-72xq2vy7bj

  • MD5

    796b323f48e37e0bfa232bb272dd2bc0

  • SHA1

    a8aae7ed34195f76ecd5bc21e5a0dbb9b0f703a7

  • SHA256

    a3d4f3ddda48e3ed9d7dff71122b7ad4dc970607634337848194fbf733c8244d

  • SHA512

    40c82f1ca61e3a0431cbd211bceb45adb0100c21ff851bbd95968aa222608470e6573eb803f17d6029c0698b536cbd534a071742b623fbdb1b9faf1568c1cd8c

Score
10/10
tofseexmrigevasionminerpersistencetrojan

Malware Config

Targets

    • Target

      a3d4f3ddda48e3ed9d7dff71122b7ad4dc970607634337848194fbf733c8244d

    • Size

      236KB

    • MD5

      796b323f48e37e0bfa232bb272dd2bc0

    • SHA1

      a8aae7ed34195f76ecd5bc21e5a0dbb9b0f703a7

    • SHA256

      a3d4f3ddda48e3ed9d7dff71122b7ad4dc970607634337848194fbf733c8244d

    • SHA512

      40c82f1ca61e3a0431cbd211bceb45adb0100c21ff851bbd95968aa222608470e6573eb803f17d6029c0698b536cbd534a071742b623fbdb1b9faf1568c1cd8c

    Score
    10/10
    tofseexmrigevasionminerpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner Payload

      miner

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks