Extracted

• • Target

    72f9d9ab0b467c913db0988f5b4126d819c1ae42844415d6d1e3df2e92d1a2a5_JC.exe

  • Size

    253KB

  • MD5

    c79e74e97d749a3e9bd428952d420362

  • SHA1

    439a647fa65ca835ae8ee667b12b368b2db099d1

  • SHA256

    72f9d9ab0b467c913db0988f5b4126d819c1ae42844415d6d1e3df2e92d1a2a5

  • SHA512

    651ff8c8c18b7986cc6da681be0718235bf7f25efcb27568d33269c277f9d47c09019dca875dc5803510741f872385ae1decf424159524636c2f6352324c7aea

  • SSDEEP

    3072:K/YZvaldnqbzvCOBds5C4Z9pGcnqrxGaK3jHTmzUj/L12rjqTu4:kQzvtBdwVzZqrIn3PbdWf4

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2