Extracted

• • Target

    file

  • Size

    217KB

  • MD5

    4d0457a1d9289c8448cb8122763c2109

  • SHA1

    050247917947b498ccbcc0e484dd2fb209217a25

  • SHA256

    72c500b08abb2a66453bf84d838767ef0e80e8db40566bd5b95604ac0e8f0d61

  • SHA512

    ef5b33d09a80ceac8bb9b37eb8d8550bea470659fdc830df0d172f204d2d55bd069b3a713a0c2534fa8366565aeca527b69fe155bf85fa0957f3dd0160233fb8

  • SSDEEP

    3072:w44ocWw8Y8Q4L4r5K6BiU4X5SWshbJLT1Eo52Oqz29Myy1gKx:/4cxY2L65KaiUrNNGW2O629MySD

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2