Extracted

• • Target

    file

  • Size

    272KB

  • MD5

    fd228d66dacf3a914214e849dcf19979

  • SHA1

    6aabf3300d2ab321ea51af659fd1c6a56ce2f236

  • SHA256

    10ec03f362b7385e68ee249d402663469b8b613dd32961bc38c7c5cd3c4b44b9

  • SHA512

    f705c41bc1281b8a57d7f6a19446c8705c85e4af9e6c32ad2686d2cfa0ddd563df6f630b262e1a72422d32af1a4a77050d752f8f06d0be5ed2894cbd61d3dfe8

  • SSDEEP

    3072:F8KnEMUvutnG3L6PG4dM2gbDNCbNCpvDi4xSpv3NY:aKAvutnG3L6PVdENCpMu4xSw

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2