Extracted

• • Target

    file

  • Size

    245KB

  • MD5

    df15de798e52159e6541c0373445a9c7

  • SHA1

    f6b9c5e494c8385c5d63b2908f7e6d5f540670ee

  • SHA256

    c9fd78bfd543098028bb45708460fe553e498c350aed74a9397061c1cc10d5fd

  • SHA512

    dcf71d349d91879761c32267d685d79765ed20db244c5e235451d2e73ea9731fa72984a6a75eb73e7503f64b38c8ab92c6ecb8f3914d92b11980499e110bb403

  • SSDEEP

    3072:K5gq7QWTvquIQSWJ5uCekqO5A+sgfoucB9hZn7gi:G7QWNFJ5uCHq4nghPh7

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2