Extracted

• • Target

    file

  • Size

    274KB

  • MD5

    049fdbc1012cb68aaa6818b61b7f4b11

  • SHA1

    ba553585b390812b6c061c5912572504629bd3c6

  • SHA256

    a16609f43e79b5beb8901046e9f3d968fb02e955e25d6e6dc3e73e59b76cee23

  • SHA512

    b0407c3908ebe8ec140a909ad7b982491ec4240b12c965aa9c6e70d615287211dcef49e59fb18959128c41834f55b27f939fe765a9aba069218babb8856968c5

  • SSDEEP

    3072:Fw9OwdZjZb813D9L1vwY4rRh9g9sPgxBU:mhZ9b85DnvwY49g9s4xB

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2