Extracted

• • Target

    98f17302b4e156486845c83ad422c6aa.exe

  • Size

    201KB

  • MD5

    98f17302b4e156486845c83ad422c6aa

  • SHA1

    83ffb44c4843b0ca414450644623897b1ffaed09

  • SHA256

    36949fde2e1880e8c86de360f71c2302c67cd453840ffd43fc1288234f3c6aa1

  • SHA512

    660e78e8419e16d74b2f7a527608f14a071e2d69f8b260090ce943b3d05d6113ec67e7a698bdea17ee0431a68ce9830d28398813cb520cacd8f77950d61582a5

  • SSDEEP

    3072:HiGTXJoDM4OArNhCqW53oPP/zRsMPVFuZmj8peC5OC7h6Bu4e:CU6o4OGNYoPP7zVF4mj8S0

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2