Extracted

• • Target
    file.exe
  • Size 217KB
  • SHA256 5f14976d98812a892a38d4e47911733ddc1f6d33e5066e1922d4d6b6b68c470f
  • MD5 41aa47215345c34fe87b054d95fa276f
  • SHA1 0fb2da48e7f914d7176a1d3499d54d9910031aa4
  • SHA512 be9ff12eb24f8263e4e53cf437ee6909c05b511ca13e16e97129f78d025528a5afaacb936bf9d2718fee6c8416bcde30cea8fae5f44f30b880ba004111264b07
  • SSDEEP 3072:O4l4rwvwm/+NpLzPeZe6qS/Tx51Qh2k0GKVWmvXt79ksh/0+rXEzex:Nlx//MLCZeJS/1srUlvXtJh/0+rQe
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2