Extracted

• • Target
    7905d79cbcea3e5b89bc08ac303f319b
  • Size 345KB
  • SHA256 3a1e3377c664b6863dda1d7d7ae9c353defc585a6df6eeb1c5147f21d31faaaf
  • MD5 7905d79cbcea3e5b89bc08ac303f319b
  • SHA1 df428a874c4970f37fe6a14e4ffadb81decfabbf
  • SHA512 ae1e43c7433331e5dec5a166d71d0686548a6eae93c2eb9ab520c280a8ff61b38e7285061765e261c0f719b5e3b40bc25983909b3add2ce0ad536ab985a506fc
  • MD5 SHA1 SHA512

  Score

  10^/10

  tofseexmrigevasionminerpersistencesuricatatrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

    suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

    suricata

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner Payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2