Extracted

• • Target

    file

  • Size

    333KB

  • MD5

    b08ce09bc71caeb447e21432944adbf9

  • SHA1

    c35f503eb3da0d55d395f7436b993b4004ca4f9f

  • SHA256

    dafa682a801d878ba74bcb69573d33d2534ca0db04f52d29206a2ad360e12f47

  • SHA512

    d74132620183939e781bdf7c7c44d242f1f32cbefa071dd29b7a0abbf87c3c47357b75ae94c8013a154bcaf78c66abffc740907ec232a21e368c99a31569c089

  • SSDEEP

    3072:BWOrpckmv8i5dcwsGiaggHrWKyF40ChzfmpiPvMm2Jd7M5SLJL1C7AqLQLybO1:gOrpbmUudcBGNW/3Qr4uEDb7cz7xIyK

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2