Extracted

• • Target

    file.exe

  • Size

    215KB

  • MD5

    cf288041eb39475dbd6cd227c263fc0e

  • SHA1

    fd4d23c2f6f6ebe0a7c14388e6edac232ba6b402

  • SHA256

    55a54a659c8184d1f2649593c5905e43f21750d96a7fa97a1f6a8a6e11cf9253

  • SHA512

    e1efa58c1276e5e9334deda1e534c881e62aded89e64a94e9b5552e9754dd3558c3555148a1b3c89db2cd87093163afb166bd08cdbd0b122f3f7e03c93b527c7

  • SSDEEP

    6144:0V/VLXz3lgJiE+z1GOTA9VKy70JVejcbXF:0VNzzlgd21G6Mgi0J4YbXF

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2