Extracted

• • Target
    b2192f83706b2fb2b9be214f19267880.exe
  • Size 13.5MB
  • SHA256 0f9a3e60242422bf0a29a4429f7c4321cb98efe0bc61cdba8efc0bc59993fa12
  • MD5 b2192f83706b2fb2b9be214f19267880
  • SHA1 4ea1a41cd6e9b19878233853d1805f0cb553af9e
  • SHA512 5d1b2c132621b51b7e4783141eae2822b7039557ef2dfbb6c17833115358b32f915ee15112725f9ec19a48d0251d0009c7ce7ec0acc8251f31ddec0c85161421
  • MD5 SHA1 SHA512

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner Payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2