Extracted

• • Target

    NEAS.1086d5f9adf63d6c82831e48cffabb2775d60789635ef6f5709bc06213ff69d3.exe

  • Size

    272KB

  • MD5

    6896508d64289108686ce180937f1421

  • SHA1

    5fd6c54b3ab237aa4caf04f98a852b130f474b04

  • SHA256

    1086d5f9adf63d6c82831e48cffabb2775d60789635ef6f5709bc06213ff69d3

  • SHA512

    29e8580c7645babd80ec0d0044220557f3e72574051572562c78b36dd376d4861cd2a02058c268edd21bbf1e2d7a0050f5117a5e483a6a7baf0e060de6c1ac23

  • SSDEEP

    3072:9VXpKjioLc3nMszZ2UQz5yrzGAeRqvigxv4T5tLU3U:vpK2oLinM8NQz5yrzbeRqvfxs

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2