Extracted

• • Target

    b71d20e4a1e5802a036f25430a6a77fbf9d30fdc193f0ea8fab29dbda81652ee

  • Size

    215KB

  • MD5

    2551cee982c6989c321a7c0694a7cb79

  • SHA1

    6b85705c7547f05f64101cc91cd12aca355a16a3

  • SHA256

    b71d20e4a1e5802a036f25430a6a77fbf9d30fdc193f0ea8fab29dbda81652ee

  • SHA512

    be34c95f449cf0856e4b84d11a6f269b38d11d1af34dc3f4755a5e2269422168befe38a3c273354e8cd1267b6b89197a2e060c628585596b5d8859aefc98e788

  • SSDEEP

    6144:NeX60Lf9ZJDfuxTPXcSg3ClhpJow0U0VB:NeXPDRixKSnpWwZO

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1