Extracted

• • Target

    01e1fb0a4795ce793f9cc3d6ccac091ad593589c877529f7e0a269d908db945e.exe

  • Size

    195KB

  • MD5

    e6633af95778725d06d9adc558c55040

  • SHA1

    3020a3b73ca13402a9bf25ffadd8fe85fa091148

  • SHA256

    01e1fb0a4795ce793f9cc3d6ccac091ad593589c877529f7e0a269d908db945e

  • SHA512

    55efc150e23b178ea53f4c3fe24ea4162c56037ad0b03a5817ec2d64401fd0d21fa07717f88abb7f96337f768fed55d3b5c54ccf8eb40002561ea47d9244af12

  • SSDEEP

    3072:gUHMJ/RMC7brSsy0ELqqWq54W22KjCp1dsLXDOQbVYC2:gEM1RD7b2sy0nnqwbjAeLXrbV2

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2