Extracted

• • Target

    03b961537434ed16b110e1187856d6fd83887488126e6f36627beff091b1eb72.exe

  • Size

    299KB

  • MD5

    45745cc2b7e41ad2e663e73112e1d4eb

  • SHA1

    27a58c48caedeb235a046e8657c9f05df829a585

  • SHA256

    03b961537434ed16b110e1187856d6fd83887488126e6f36627beff091b1eb72

  • SHA512

    d40f981d7d7bdb8f60db4746f27cb7d4639b181f98e7c1664a8d8c37af95353491bb80a7c75557379e9138256e2398ac90b5e48d02665f11024b54a7d471f805

  • SSDEEP

    6144:C/SlLSuD8yVmbWuM3XPbRO0uQj9JKO48a:CKlG/ykipXI0ljK8

  Score

  10^/10

  tofseeevasionpersistencetrojanxmrigminer

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2