Extracted

• • Target

    bd4e8361911dabb59f382e52e26614bbe08c0f60da5cfbaa412a8b9e2423587c.exe

  • Size

    283KB

  • MD5

    d50cc359381325522385b32fb37aa695

  • SHA1

    f63ee5b87cea7e2385b7800c0f5728960546de70

  • SHA256

    bd4e8361911dabb59f382e52e26614bbe08c0f60da5cfbaa412a8b9e2423587c

  • SHA512

    2c106b342402668158e9e55495929ffb99ee00cf1063f3dcb538880aa967b70a123a5603dfb92d82d71842eb4b7e2cc4bc268e49c97473a8924c91b474cce220

  • SSDEEP

    3072:1aHQFccmfkw9dCj/fkjFYmGX6jAAVfcezSepGt1U1wdwSDr9:YHQFDms8dCb8jSmSWVfcez5AdwK

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2