Extracted

• • Target

    93cb2741e6805e68eb87266ec29e21f7138e609d4940edb1bdbafa47426ea0f5

  • Size

    312KB

  • MD5

    ef8b14df3ec4cfe498948989a77910ad

  • SHA1

    48cd7aa491bf373f6e959178ef5fd8d9ba688c82

  • SHA256

    93cb2741e6805e68eb87266ec29e21f7138e609d4940edb1bdbafa47426ea0f5

  • SHA512

    bc00dc1ad7825bab55349e47aaff03102545374f82e777f6e96b7e16f88236d9fca3766c07bc9e9470d2e32b38386e6eb57c62750b137a85f1cd4beaee9cc90e

  • SSDEEP

    6144:2S7LKg5EpQN8fYMQTEFEIg8XfVMqdWKQphEUor:2S7eg5fPMh9XdMkb/Uo

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1