Extracted

• • Target

    file.exe

  • Size

    301KB

  • MD5

    ae9dc34b6a8ea00485a79cc48fc59662

  • SHA1

    0e623ec7aaa91275e2fb0bcad85caa360b1fd296

  • SHA256

    3878ebdeaa9e027240ca37b48fc74c9d1f1e58e17708d33b050af65cc2ac66e1

  • SHA512

    a4dd1994fddd471c5ad4394e4c85f9f762bc4a82286d5e902fc5b837d7a9bc5c28e2098b802e21243d833e7b1f8fc6f154857f4712c721d0d1e25d383508a0ae

  • SSDEEP

    3072:CBLb6b6cLxMRGDLx1l9yy70oMh5KGlF2Lw9M4uQjiMTE5/3RbPafVi:C1ZcLxzR1/ooTfLw9BuQj9M3lPat

  Score

  10^/10

  tofseeevasionpersistencetrojanxmrigminer

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2