Extracted

• • Target

    e0323f01296a4a7fea387c3c21232105dfbcbbae5f2a192d714de9a5d18a043d

  • Size

    303KB

  • MD5

    9b2a0fd99f5f9bab7c3ef56ba54a974c

  • SHA1

    205fd75316a9f533bf1f9af8a36571f587cff9d3

  • SHA256

    e0323f01296a4a7fea387c3c21232105dfbcbbae5f2a192d714de9a5d18a043d

  • SHA512

    a64e38488b5fc333a2432cf4b53db1e9793e63cad58c4c9ce917078ab16073572a70804a6e51587fba1ec0c7dcae38a6e2c7d6f916e0df4160d196a3a8ea8f84

  • SSDEEP

    6144:GwutEY/qNDJB7+ky9qGj+DSLzv9g8FKxWq8a5UGBsuUo7S2RzLB:phGq1JB7+TkG6DSLzv9bnGBsuUGS0

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1