Tofsee

Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

Windows security bypass

suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

xmrig

XMRig is a high performance, open source, cross platform CPU/GPU miner.

XMRig Miner Payload

Creates new service(s)

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry