Extracted

• • Target

    4ce2353420b3fef9a268a018a0b8bb5d4389bd7ff288c1168af812dd81b2d54a.exe

  • Size

    192KB

  • MD5

    941c2c7de7a78108baf55e9a9c80db7a

  • SHA1

    02d1c8e2027be98a452e2bc6c8e4f4359e114443

  • SHA256

    4ce2353420b3fef9a268a018a0b8bb5d4389bd7ff288c1168af812dd81b2d54a

  • SHA512

    2b0102f34315eb971d4ed7fa2ba60ccc0afdb1ebdea3548de2b91763d5b105cad984dad06b12a5c28ea36144dbd81071d69fb3833259a04763c8b398d0984ea7

  • SSDEEP

    3072:A0Uyh0vf5cSHc/onUnPJaBOkSSgH+wIygCd8ZXQm25k5gFaJc3EB:Zph03LHc/yUPh4ogCigk5gj

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2