Extracted

• • Target

    9c9b7260556caeabcb0503f3b105b059b1d7ad78c7efc12d15ba506e7e2c2052_JC.exe

  • Size

    254KB

  • MD5

    8711b0f84531c6aa872bd7b9cbafe866

  • SHA1

    71e860db1fcd61be5c5034c1a6e7f60db822c32b

  • SHA256

    9c9b7260556caeabcb0503f3b105b059b1d7ad78c7efc12d15ba506e7e2c2052

  • SHA512

    236df6134cb8ef922beced452948bf736bd8a3481ab084b76072570357b971c779ef809497293775cb75f98550af52510e87108b161c695df35bac917487e6c3

  • SSDEEP

    3072:geTmM10cMLLQ6vbxXhBjOlUK1Pm2jWyhG4OK8ZzIMxfezD80:MMecMQ6vphBq1NrjWyhrAz/xW

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2