Extracted

• • Target

    a2f9d1e93bee957121bb9838ac5dfe298fafe265f7494cb4a2f4f61b07f59288

  • Size

    215KB

  • MD5

    dd9f4586f7173087c04c28b2e637ea18

  • SHA1

    a8b1f59d9aada59a76b7c24c29e3d415581cf3fd

  • SHA256

    a2f9d1e93bee957121bb9838ac5dfe298fafe265f7494cb4a2f4f61b07f59288

  • SHA512

    2fc870d880e537dcfdef7ed4ed32623ca722c86e5c006e04a85382b24b262be577d61ed822c4ccddae840b8a49fd4caa9a66b32da41cc07a1f5bd85446e7b01f

  • SSDEEP

    3072:k4Pam6LOQV5q5KqGTv5WuD20PBmNy1OPh7b/Ime1WJ1NHCDml:5PKLOzKLrEuiwAMOP5DeMHCa

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1