General
-
Target
8450ef674fd0c90136e6cdd810d510ade0cbb8d60b4a47ed563d3c9a0a14a801
-
Size
209KB
-
Sample
211211-j7clcaccck
-
MD5
cb2412d7c6cd6d8b942361f482655a4b
-
SHA1
ce43dc2225354f5536b795ae307f1a7381c2e566
-
SHA256
8450ef674fd0c90136e6cdd810d510ade0cbb8d60b4a47ed563d3c9a0a14a801
-
SHA512
67332318a7eee352b1fe4fbe8455ac2841b233257103391b72fa6859affc724e9f8c508c055780e68c681567e74e104c572f2b90240c84000793a2c9f0244305
Static task
static1
Malware Config
Extracted
tofsee
mubrikych.top
oxxyfix.xyz
Targets
-
-
Target
8450ef674fd0c90136e6cdd810d510ade0cbb8d60b4a47ed563d3c9a0a14a801
-
Size
209KB
-
MD5
cb2412d7c6cd6d8b942361f482655a4b
-
SHA1
ce43dc2225354f5536b795ae307f1a7381c2e566
-
SHA256
8450ef674fd0c90136e6cdd810d510ade0cbb8d60b4a47ed563d3c9a0a14a801
-
SHA512
67332318a7eee352b1fe4fbe8455ac2841b233257103391b72fa6859affc724e9f8c508c055780e68c681567e74e104c572f2b90240c84000793a2c9f0244305
-
suricata: ET MALWARE Win32/Tofsee Connectivity Check M2
suricata: ET MALWARE Win32/Tofsee Connectivity Check M2
-
suricata: ET MALWARE Win32/Tofsee Connectivity Check M3
suricata: ET MALWARE Win32/Tofsee Connectivity Check M3
-
XMRig Miner Payload
-
Creates new service(s)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Sets service image path in registry
-
Deletes itself
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-