Extracted

• • Target

    file

  • Size

    274KB

  • MD5

    5c35f8f54a25a18450a925821a7f4ba6

  • SHA1

    5432db03a23af857350e3c70064ead8f68f33e20

  • SHA256

    88dea8a4856d30c952faf8bde72411e6152458f6c563abaf5d7e450cb822fe7a

  • SHA512

    8cda8d37e192804439616c6d515151ca45bba2e3f2ade7904b81663780a1554853101f08bb7f8407cca087993bf05500d415fbfaaddf6b85fd35848d1b3b4bbe

  • SSDEEP

    3072:0jXOHVwPBAI9BvDXcm0m+ND1A38jYsE05qU3i6wU+4l8QU:SXOiPr9BrXcDND+38ssE05qU3i6nZ8Q

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2