Extracted

• • Target

    16748f1d7d82bd3acd3c128431e247fd0b393d101b1f4fc0cc88cd0eca21296c

  • Size

    266KB

  • MD5

    1b3ef6f08e9b680b93377c641facc76f

  • SHA1

    37ef6757a8ef679c68440016f166d72dedc6a8ac

  • SHA256

    16748f1d7d82bd3acd3c128431e247fd0b393d101b1f4fc0cc88cd0eca21296c

  • SHA512

    233b99cdb2a2d662802a5d7c38806c91cb4ffe1174008f6ec6737ec772eb0c2fe51f05381334e3b280c37b18a27691083a58697601402234f40e8c1bcc94e2e0

  • SSDEEP

    6144:ZfA1RoiIiDjl/Q7oUaOdJeXb5t5rrkipNg6vqTJYdD4I:1qoiIiXJQ7oUaOdJedtdrkipNgf9E

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1