Extracted

• • Target

    file.exe

  • Size

    278KB

  • MD5

    d66e10f9ab1cb1f29521b054d2676cc1

  • SHA1

    28923dc44986d18ecad140db3c0be616916e2b6d

  • SHA256

    612ba43df412385b770bd5ef067bba8b852ef41ef2dcdf785a017d5d0bb62de7

  • SHA512

    d7e2c2fc786c03d3b195b54db2d82011fc4e39c94e2089768fa22409a0c220d297f2c04a65148ca7fc201b14292286aa02cc8c5e43a62a032a9b86b380535cc4

  • SSDEEP

    3072:7XEO22zRKzpLLtmjf9i5GCo5AmmHyy58KFRt+fgIgHplfehgRfQU2m4FwCpjKpEe:T9zRWLyf9kGCg28KF7HvWhatnEmQLr

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2