Extracted

• • Target

    abb89870a6ffac63572b4f2026957ee5c75eaeb17db0eec61629333da244ba44

  • Size

    256KB

  • MD5

    fef3091059af5ae452cd4554a7fb2f31

  • SHA1

    6716795202f0eb637e61b5c2e12561e4587b322d

  • SHA256

    abb89870a6ffac63572b4f2026957ee5c75eaeb17db0eec61629333da244ba44

  • SHA512

    f895a12bf19419bdc0392b215d135acf2acd0479ca632b807529a68c52cfb60603bb9a462c380d2c15031819e87db6ce13cc987ac385891dabc31760401e6a6b

  • SSDEEP

    3072:yr992I1yxYhjZjXLR1EalWmPEDUvz64IeF+GA52A26Q3GLeJig/oGOUZ:TI1yK1LRuaQmP2+B9FXRGKJ1o

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2