Extracted

• • Target

    45b56889c1a9cc3a57cd8bce999914ae2199808ad38235dc53c3e9d041865a07.exe

  • Size

    213KB

  • MD5

    bedb55ac5c140a2a596d9fcbd822e5a6

  • SHA1

    cbd6195cb310f5e29c199c01180a424340266b80

  • SHA256

    45b56889c1a9cc3a57cd8bce999914ae2199808ad38235dc53c3e9d041865a07

  • SHA512

    be312de3dbf98fc18fabc2970ef13c14d291ed528b502f7937b2efd4491b2df5075ae31f878085af67c679099ebebefa9ea38ef086b4d7c4292a93e5c841d798

  • SSDEEP

    3072:QLw69nh47SsG97WGBbZrV8O38yLTMaOGpID5++qI7iMP:Ah47fKL58qjvMaH/k7iM

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2