Extracted

• • Target

    c93020e01233f2935a6fba66fa3e3ccc38b0fc50bacd0a374c1130910f821935

  • Size

    251KB

  • MD5

    3289ff07ba3c5b4ea9614f862dae3bd8

  • SHA1

    30b15edf7ad3f7bc059f58436198d5619f06a53a

  • SHA256

    c93020e01233f2935a6fba66fa3e3ccc38b0fc50bacd0a374c1130910f821935

  • SHA512

    9e90abf93b6e7268a0c8993c864d9b106c00990f77c1d8011ea7325a0467332f508f04dc083c46880dea9a71a9a6fbf6c8bdcec83b310093eea0c455c66e5a82

  • SSDEEP

    3072:7RoP5wl8uJh5E7jjzFApPWASdKogJodIj+5JjAxSdhee3hUDxy/Ocat:toWlbhOTFApPmdKogJc5JMxUh7OQG

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2