Extracted

• • Target
    90e20bb989d503704c16faf8e852e6b7
  • Size 334KB
  • SHA256 3abf5e573cbcc7b375436931ff07be0d9d13085cf6a14f9cde285a83e7ff528e
  • MD5 90e20bb989d503704c16faf8e852e6b7
  • SHA1 1e0461ece662692598fe4281044fa1c0cd7fed31
  • SHA512 37fe33acc98e1331e7bee70b833664fb80a335581f96cb538d8d7c0cada1bade60e1a69a0caa78ffbf6a842519acd2497e2a388901060d2aac39b6020975f6d7
  • MD5 SHA1 SHA512

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner Payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2