Extracted

• • Target

    file

  • Size

    295KB

  • MD5

    5b67f2c18b61f0fd4ed4343a7e5f3c17

  • SHA1

    4229dbbb3278f547976e13401bd1c19d27a37c71

  • SHA256

    8f10b0bfd5cfecd77dc53dffb7d1e330c16066e38561eacd1c189a1f2b23f75e

  • SHA512

    033dc2f129e1b796b1bc5fb5b9bbd3d4263fa5fc23b0265b4f8fe6898aa150d38eae5cb33e3de4be4a95271f6d4870e1d3525aa022c5879866e5cf02f0dcf0b4

  • SSDEEP

    3072:0FyUWKBCrBhus7m7dW0zO0jj2rHMzndb2l0v1hil7w:KyUWECNhus7msCfjj24LN2l0vDq

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2