Extracted

• • Target
    33e6609db7b2f9c606acb158b79bd795
  • Size 338KB
  • SHA256 b8bc5b89e9a8d80cb70f83dfae264e47fcef7bc5f1840a5b68b496ef62a2cbfa
  • MD5 33e6609db7b2f9c606acb158b79bd795
  • SHA1 0de306fbd4dcc1166003c46b6c11a88616e3e2c9
  • SHA512 ea711da1741c64849e3bb122d5eaa862b8d845152041b5dc684f85872c3203fe5285cd843190a2fe00b8aef6b30d09f57e6ce411362fdbbbe1f601c103f12185
  • MD5 SHA1 SHA512

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner Payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2