Extracted

• • Target

    390f4f020e690300200db6b8cf00e5cb4cde887b8249e731a095aced7a1bef82

  • Size

    263KB

  • MD5

    a35ce6fc97aa8fa54afa43808153bf33

  • SHA1

    3285adb85971400d48016ae77e2834646b07691b

  • SHA256

    390f4f020e690300200db6b8cf00e5cb4cde887b8249e731a095aced7a1bef82

  • SHA512

    32f7c0b61ba49438d89aed522898459bf34553f6385d4e394d3a0fcc56c02e589bfec74a927867fc578d7bdceb4eba622183e85c04e38afd19abb39ba85f68bf

  • SSDEEP

    3072:XXhV3FBEGLAF/jJNTvQp58q9ZL+OM/GY/Bs/WCQuLKWFV5iXpxOxqKPhKUZNTKXX:HwGLAFNNTvQnLEnsxQQKwiXtKPhOuN

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1