Extracted

• • Target

    3d7606fc3298682a7bab9a98a94dbb55fd0afe95302991e439867fe3c46ab4da

  • Size

    268KB

  • MD5

    f6f6397493ea8350b4550da03337fabf

  • SHA1

    16b6108d0b58ac938016bbdb5934fcc108cd6efc

  • SHA256

    3d7606fc3298682a7bab9a98a94dbb55fd0afe95302991e439867fe3c46ab4da

  • SHA512

    dd2ae41b98dcfa2c2c119ffb14f94eb323845cdc634801c77fa0d5a748b69e55dece38591c39786fca1e0c4ffbcb2d10b5526f92f00759d4047a234e00f512eb

  • SSDEEP

    3072:rXiQ6zGDbU8V3XbZl7IZeRU5Thu4M6nF6MIH8UZodGV0aNPd7I2vrN0K+:D36zcHdl8l5Thu4M6F6VZodGTMQrN0/

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1