Overview

overview

10

Static

static

1

941014493d...6c.exe

windows7-x64

10

941014493d...6c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da5e4cbc3f49077078c72d5bc35d2490.bin

  • Size

    164KB

  • Sample

    230329-b5rngsga5t

  • MD5

    07eda4e47d02a0f143369f85943b744d

  • SHA1

    2e0b4dfa8a8862a282364984312f88ec72311032

  • SHA256

    9851e1ccf074df2bc33560670afea435215a0baa735e788e9290f1cd3ad2c797

  • SHA512

    f7b0eb9f416ca7ed6a35616d8dbd46be6658e6b2281187f38f816f2733b1ff445ec0db3cc2508a120f695895de516b9a36d0374994e199075b919bd7770063bc

  • SSDEEP

    3072:iT0XhEPIBAWuLQr+pCSITtoqBOYq+jmqMg4z4MAijSaZ7bjRICA:8WhPAtlppITGoq+iqMgNMACZ7btID

Score
10/10
tofseexmrigevasionminerpersistencetrojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Targets

    • Target

      941014493d71c401467dbfaa6e177ee7ee07486288350c6d45d1d2e9c3abec6c.exe

    • Size

      250KB

    • MD5

      da5e4cbc3f49077078c72d5bc35d2490

    • SHA1

      902ec3ac8390ededea2c9bcf3ec34a2d3394128f

    • SHA256

      941014493d71c401467dbfaa6e177ee7ee07486288350c6d45d1d2e9c3abec6c

    • SHA512

      0364ac8c2c2255c2c241739bd5a002a6542eec74613cea520e374a5fcccfd56576fccd40f22ffb2fd2c4955a51c815346e448562ebf2ab0d441072b83ea1c120

    • SSDEEP

      3072:IbFEBYrR6uEi8dkShLWlzECOmVcuGRrPVli5NuosnGboLj/8sj5qrSBKni:IBOYWiEkShLW9E/mVcjRhw5w51QrSBh

    Score
    10/10
    tofseexmrigevasionminerpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks