Extracted

• • Target

    02b4c3dcc4673e8e5b5209e2cbad26584be30b40b082d0bf906ae4d60e9487a2

  • Size

    260KB

  • MD5

    ef7e4a69cb1f773ee7b5ac597f06418a

  • SHA1

    7c09ac3d21a7e7866f8a74c6e39f496a75e005ee

  • SHA256

    02b4c3dcc4673e8e5b5209e2cbad26584be30b40b082d0bf906ae4d60e9487a2

  • SHA512

    bec3b85d3bfa56ab5b1427d870f81bbca45a3bb301c524eca29960185832a3664d449e8d4d320926139d3ec97f425b13e6fbd3b62adcf09987ad82c40f80a7a7

  • SSDEEP

    3072:LuJFB8IkKLXHxuvz5q3jzQctU7cw0e7hwiXJl8T4DKFbJOxjw0L9l5M/h3:+FBFTLXx9zQctze7yiX4kMOxjw0xT

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2