Extracted

• • Target

    799c987ad840fbd563a1bd09f694958c07be362104b88171b423f2af4c395dc4

  • Size

    276KB

  • MD5

    579bef931c82955a57587da5bbb15866

  • SHA1

    49524805286b19afc22f227531bf64146c88ae48

  • SHA256

    799c987ad840fbd563a1bd09f694958c07be362104b88171b423f2af4c395dc4

  • SHA512

    f21dff5d462696a067aab843a06dfb7b0cb3e1fa931693046089f33dcb9011e331bd83a99b5c5666df2d7ed59b7af5b2c02f4138cb1280a1b0d4733a0aa0ca65

  • SSDEEP

    3072:X6qeH/j3LXZp9I+LmqGm1+0C+7Fys1/mQqeZApUn2/LhRXQLOPf7ovbeB4:AH3f9I+aJmYEhys1/mdDp5/TQOPTM

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2