Extracted

• • Target

    af1f8bbad036ff943da3cd7b1eeb87fd71ec94ed57a1549d6001ff70114d6a7a

  • Size

    228KB

  • MD5

    24f0d99b81da9c338b180b7fe2d4b04e

  • SHA1

    bd6a3e322abc1194784ccadb30aecf532dc9d910

  • SHA256

    af1f8bbad036ff943da3cd7b1eeb87fd71ec94ed57a1549d6001ff70114d6a7a

  • SHA512

    3e184c9cbe0cd9f6a3869d07cba9122f2818d758de93a6a3f50ff5f7dc4e6dc5d8c7c2110481e63c46bd213c32af5ec5a0d165ec15f8dd2a58185cb4b430d2d1

  • SSDEEP

    3072:/EeLLQu5/f8v0A/SIx1gxdnHx7M4o0QgjLptBAvW5+V+Y700:RLQ0EcAkxtpMP0XHUi+Vl7l

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1