Extracted

• • Target

    file

  • Size

    232KB

  • MD5

    f18c94e7d8c0eb55ca27f0389b48027b

  • SHA1

    322a633c51d48858e580955380cbe96f29840ce4

  • SHA256

    8121b07538fee52be986b858770edf3ba65724d1bc778fee35f0f3ca821c42b0

  • SHA512

    13c195bddc24805abb45e684b9b9b6e57aaf9880abd00b2e5b8c5e86c4b531c75d0235d4b624b2d0d88b095a2733485c551e9333ac65f6ed8a714260b9497da5

  • SSDEEP

    3072:bZVhxIRRf0ZOYyw6HxrYkxdHHDS5BBetfzahPTVro:dncRfkO1lHR9HHCBet7gPTV

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2