Overview

overview

10

Static

static

969cbe894b...b3.exe

windows7-x64

10

969cbe894b...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    969cbe894bade6e664ebc759576a44abba87e73dc093e09b7a97ec3c1099bbb3

  • Size

    105KB

  • Sample

    221129-z7ecyacc2y

  • MD5

    4987b9d476ba9e21e256566b56ac28f0

  • SHA1

    774d656c813b65daa1543cf6d6f61a3025bb4ff1

  • SHA256

    c34ceb9ee84bec57a14766d8d240ba36aab3e69daf53d1a7cf321b5d2372dc38

  • SHA512

    6613342519493d21fb7cabe8e67d1762f1d368a6d73bfcab70063a52a62c74494f09167c5fda4e5535005605aa81b99f6e2bc4ab63d1fd9df2ed97369226524e

  • SSDEEP

    3072:sBKop6gyBYFNzeOi5hL5/SxJ4aOEkYWpRudv7F9vtk:sBn6g5Dzedhd/IDkYWpRuTHk

Score
10/10
tofseexmrigevasionminerpersistencetrojan

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Targets

    • Target

      969cbe894bade6e664ebc759576a44abba87e73dc093e09b7a97ec3c1099bbb3

    • Size

      147KB

    • MD5

      bf64cf006d94eea938529abb0e6b4ee8

    • SHA1

      2808b73fcee94aaaa39240549c616f1d97eb8839

    • SHA256

      969cbe894bade6e664ebc759576a44abba87e73dc093e09b7a97ec3c1099bbb3

    • SHA512

      a5d281994b61c3664cfa3d783a6f2fac17b57ac9a2fb01f69534f11dcc70ae2229a0ce7b1ce4dca2bb6ee5ae9f29f17dbcc11a721cc93ce7f0aa098a055bbf23

    • SSDEEP

      3072:qxHNuRGCqn5Si5hL5/SxJ4aOEnr8LUwHx/r0NfuCOD:iGGCEhd/IDr8QwHdr0Ah

    Score
    10/10
    tofseexmrigevasionminerpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks