Extracted

• • Target
    5d21f809eaaade73ed06d17823f93731.exe
  • Size 208KB
  • SHA256 9cab0c7efdafdcab54b20bf295f36ecb1cc35cdad27dddb7b568a637263e8003
  • MD5 5d21f809eaaade73ed06d17823f93731
  • SHA1 0e338358fb64456917e36d7c264aab9b08cc9f64
  • SHA512 7ed295e4482fe7ab8f9d9a5209d10176b28342252bc7b5f4f493ed315a6658915e1ce12c8b3acb9f78574daa35a5b386b375979836b20fb34bfb74841cc02acc
  • MD5 SHA1 SHA512

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner Payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Legitimate hosting services abused for malware hosting/C2

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2