Extracted

• • Target

    file.exe

  • Size

    304KB

  • MD5

    8990b4f21245d78cd1fcdbaf6f0561e1

  • SHA1

    de8c27206b12e2b165893cf83a73df2ec4c47b53

  • SHA256

    ad70e9386cbcff9534f6c3f2fc921f1f468f13e40c9b489cec17de81f0401de9

  • SHA512

    9034b6c1fa99482a37dbe915948f05ee431c8b07ffc20956d456fac70cc32fe2e8a39ae725e10d5653000a16da40a0d40dc948de9d19418993acd6c05d1a207a

  • SSDEEP

    3072:A7z8tLu+YG25MX5w/ip0cZxezBUZVMo7DVEmRkwxOP2d+77h+y65/1E3ZJyyjXgJ:CeLGBM+K4upEm2wdwJ63QZImQKG0

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2