Extracted

• • Target

    file.exe

  • Size

    235KB

  • MD5

    cebfc9645b080c19ca29154ed4fbe4ab

  • SHA1

    2de92713f76bbfd4f455be2146c5e890ea41e6a0

  • SHA256

    8299a18a6f137c931988ad6e1f68e99240c02fc765bdf37beb652b39d91fa822

  • SHA512

    4836f50f24f3320370e54ab35ea695ef4f8e2008757192ae5b93581b28a108c40792bd515053f2af8f1446df59c8d6c30b1334426aea790b8854393875f2cd8e

  • SSDEEP

    3072:bUPv9wTIHrDRHV5JCdezw0OU9c0WAwnxLYdNfD/e8h1lGtYEZllNHwh+LOb3TYtq:QHKIHZVnCD0PVU6bGHZf5sLbDYt+

  Score

  10^/10

  tofseeevasionpersistencetrojanxmrigminer

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2