Extracted

• • Target

    file.exe

  • Size

    220KB

  • MD5

    b8801008c417b5243fc3f23efd398464

  • SHA1

    103c056f4f343f61022b727a4b325bd5f9c50c69

  • SHA256

    9ed5c8903da45b632845d7a4288e2da852650ddf6762068908da5b6e6b70c9a6

  • SHA512

    e17434f7e6ec74d74b268b36afe80d5400339963a8b8b2972b8342d629f0b7e89d3a0dd805a412f01d34b30deda6238898d64b80bdc245b8f93c70862f96f4d5

  • SSDEEP

    3072:iPqFpLpqwt15WI/PhYR1e58niPr4V7b/oU/Yw8Co1NHCDml:NHLpqw/3ee5WiPMFww8CoHCa

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2