Extracted

• • Target

    file.exe

  • Size

    327KB

  • MD5

    cac294181b203b7842a3cb7f088abcfc

  • SHA1

    0f29d824da088340a39e1806a718d9132bc7441b

  • SHA256

    710e157f1b500c71193bbeb23a2f6fbd492a9ad47a13256b1d058e864e0908dc

  • SHA512

    319f074816133158ced69e9db6a5a1756af61fce613d7adbe429f3ee4a3ecb113d0128a3ac13cf1b3f46dad4a7dadf4f9ffcd237a9a5fd0c22a6e34cafdb81c2

  • SSDEEP

    6144:n+HG1UJcOEexoWDNRTlGOyyDqCFH0iXlG9:ne85OBoWDNisOCysG

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2