Extracted

• • Target

    file

  • Size

    195KB

  • MD5

    4c9908656905016acaf1ba84d0b38ba6

  • SHA1

    a9b3f47da19f997a6605a7206a5945bdb27fb7d1

  • SHA256

    658849d3fcdecf3a960c712819bc8e2eca2e0b53e6313e77edd3410dfd2468e8

  • SHA512

    bfffe33888da925a982db65fde5aead46e6d76bc636f5edbfbf6040fd7a9658b3988d446f69939594514b6056fcf3f39189512450e6222add8afa46f06daf34d

  • SSDEEP

    3072:CWaOOKuQW6rorQLpLLWAz+85g9Qha2ZLaxsan4pA+EEl34MdAYzoci1pms:jaO9/HLNLOLwLaeM4pATEZdAY9i1p

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2