Extracted

• • Target

    file.exe

  • Size

    260KB

  • MD5

    668eab4e7861433c3f9be42c3d243735

  • SHA1

    187ace33301253399570e27b932ae969737feced

  • SHA256

    072ccb1fdefeec0c942ec66943a650f9ac9fab1d491a255cd8db9f0ab4dc20f4

  • SHA512

    fbc2f651464346d8945cf9d34dec51ca0a4e61332c627b6fa66ac9a458c9ba38801b0f9e3cc585808d6663438fdab8a4729113e2148230e67a95f240ec8c4031

  • SSDEEP

    3072:kOXEYTwAL9pev5tZnt915pZxTv+0uR5+KEqARuh9hZCRRzMuWZgd3n:FrLCv5tZntvTTuR5+KEU1cqgd3

  Score

  10^/10

  tofseeevasionpersistencetrojanxmrigminer

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2