Extracted

• • Target

    file

  • Size

    284KB

  • MD5

    d1de288c58de023e8aad492868da3b92

  • SHA1

    530d8675705fee02d103c076706585f8f7a97de2

  • SHA256

    ead20c77e005c89bcc2a699892caa8775d7a7aa2c15d5170fd3d4b783f8f3ee3

  • SHA512

    9179f17800fe35a816c3dc29a6d936e56658f253b83fac6c396cad5fd2f8c2c4e0beb62013c4d2625e13a5ba9ba7332f5bbadb6702eb441cc1a07e995365906e

  • SSDEEP

    3072:FcSalqHSwBWbacDEgFAdpW1Z8AZLJDAM/a9:taYlWeeEucpCZZZq

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2