Extracted

• • Target
    a1d23796732487b40ce43b22983327b2.exe
  • Size 279KB
  • SHA256 84839e5c70038104b4d9fbf20988ebc952ea698be6d46c0ad5ed072897427b3f
  • MD5 a1d23796732487b40ce43b22983327b2
  • SHA1 a9b5b16d21b145997a803857a743ce79ac0383b1
  • SHA512 2521705f6645ecd3897d880a2d7cadaadf9fe790715a5a026b564d4fe498f1cea2bca06fb2fd4dd1e3b0a9e3de50a061b48092dde6a97634734b8a68b4b30df0
  • MD5 SHA1 SHA512

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojansuricata

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

    suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

    suricata

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner Payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2