Extracted

• • Target
    a8a82181892904c5623086befebae535.exe
  • Size 10.2MB
  • SHA256 a9416f3272c3accd4215cbcbd8af56b6fabe9b05a0ef552e5004edb272ea8abf
  • MD5 a8a82181892904c5623086befebae535
  • SHA1 91dcb4028f4bf11998e2985ec157e32885dad464
  • SHA512 27f98dcb40618fd7ade9d5010aad4f0853e166e02c496d57a669193ad582a31707deb8f0b004254993165b762a13df000e9f30a8177583e21e3942f5e59889fa
  • MD5 SHA1 SHA512

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner Payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2