Extracted

• • Target
    c9bb0263f1f8bcf29205aa8c41184fe3.exe
  • Size 337KB
  • SHA256 925c11560a88096bc28480d802d69da132ff883236e0d8dfaf9a367fa07cc245
  • MD5 c9bb0263f1f8bcf29205aa8c41184fe3
  • SHA1 0cc3469ecce6c9989c491acc306de24c0ca75d6d
  • SHA512 3ea0159ef83ed2104e85dd22c03d1ad3ef691f74035482889c82ed91780c2d832f94f46227fafc457e33a569d013a9526613e92bf42c684182a7e2d080750859
  • MD5 SHA1 SHA512

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojansuricata

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

    suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

    suricata

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner Payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2