Extracted

• • Target

    file.exe

  • Size

    213KB

  • MD5

    d2094e5b150e93824c03c5de2a70a6f3

  • SHA1

    aec0ad2bba9c795f70a192f67a48b049ebfc1b4a

  • SHA256

    781d970efbd869d9f9d6133d4c5fd95e886be5d865be20520c4c9b646292a114

  • SHA512

    49094072b9f3a1e21b0c8d234ce1585a77c627567beba58c4ce3816546eeab634e702d33795b52b29576d6b7feb0a9ee422304bd41110987169568ab37386e60

  • SSDEEP

    6144:NB4zZU424TLgM23XjrgmETzpU3LvUUUv7iM:7cZY4TUM23TqV7

  Score

  10^/10

  tofseeevasionpersistencetrojanxmrigminer

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2