Extracted

• • Target

    file.exe

  • Size

    260KB

  • MD5

    2217a7dc1aa0b5ef18f73aeb4f996d2c

  • SHA1

    2a427ee930b5c575d1ba27eced532570260d515e

  • SHA256

    159ac8af8578d932513d407cfec08d07cc9ea3ff48797cfa96b7c9d45c530554

  • SHA512

    815a66ea25678898be26fe12573c490cb15d4ce3f633ca865d30692425862251a98291a0b705eb148b8017fe139def2620103786997aa836ef281bfd1ea5a8d9

  • SSDEEP

    3072:249jhOaFQDZL6Vh5Fe1uwXbylxgCt9IXiDusLjM1uKNcL+uqHs5xbtufPWQ:1CDZL85KuwGlqCt91D/A1Jm+g1

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2