Extracted

• • Target

    file.exe

  • Size

    321KB

  • MD5

    59698164011560e61011db2659fea20f

  • SHA1

    70cff9f8aa8561d0bc6b16b4462cf264f1cf6076

  • SHA256

    824d5828b99e7129efd43830a9c714293682cf9085393623fdd2b617d3f98c68

  • SHA512

    f10ac00cc7460a630bb5c59dbda948eae2e655078774df221baf51dacddd5b388b8c332f1cf4ec28449096fcd67fa7796b92b1a201240f9e55b0b1a840747c07

  • SSDEEP

    6144:L8wlmU3y6BnUbpx74EcyA4rwTH7TIkjxmf/y:LtUWBnUbpxcEczPTIbq

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2