Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92f1c139cf2ec28c65862557c88d202ba72577e2a9c2c0161dc4e6f90b63076f

  • Size

    328KB

  • Sample

    220121-v8detaadh6

  • MD5

    1e21be794ba44648e8d58d201d6e5593

  • SHA1

    ea135e084aff6813bc743fe51fe4e1f3a2277ac9

  • SHA256

    92f1c139cf2ec28c65862557c88d202ba72577e2a9c2c0161dc4e6f90b63076f

  • SHA512

    8de25058347a136b8c60e2b29ed1e820ff8d43647e46a6f68d89a077d1cbbf22bf8516ed3b759f2b8e467e6fe2f128c4b312d15b05185f2a856927f92fbdc656

Score
10/10
tofseexmrigevasionminerpersistencetrojan

Malware Config

Extracted

Family

tofsee

C2

patmushta.info

ovicrush.cn

Targets

    • Target

      92f1c139cf2ec28c65862557c88d202ba72577e2a9c2c0161dc4e6f90b63076f

    • Size

      328KB

    • MD5

      1e21be794ba44648e8d58d201d6e5593

    • SHA1

      ea135e084aff6813bc743fe51fe4e1f3a2277ac9

    • SHA256

      92f1c139cf2ec28c65862557c88d202ba72577e2a9c2c0161dc4e6f90b63076f

    • SHA512

      8de25058347a136b8c60e2b29ed1e820ff8d43647e46a6f68d89a077d1cbbf22bf8516ed3b759f2b8e467e6fe2f128c4b312d15b05185f2a856927f92fbdc656

    Score
    10/10
    tofseexmrigevasionminerpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner Payload

      miner

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks