Extracted

• • Target

    0a731a60eed64ed8a1b2b5617df6d248b02d8a2c7716f13877a4398293fc9e04

  • Size

    338KB

  • MD5

    cd6e356156ebdd1ab336982ee3033203

  • SHA1

    bf2c44a833f60a5b3d3465d8a0189bdfaa60b851

  • SHA256

    0a731a60eed64ed8a1b2b5617df6d248b02d8a2c7716f13877a4398293fc9e04

  • SHA512

    9f0483e5560a16f80fc3a8f96039a591fa64efad0b5d39fd31e9fa2e617289abe6fc611a9e95dbd85207c24ab0f60c4090a36c117b02fcfe4c0a2c3b8d3aa626

  • SSDEEP

    3072:O9xAA69UJ+xOWELaHcHjmZlWLjv6iBnTDEvpDfqxO2Rer2dbp80C:GuUJRWFciZlWfZTDcpoQr2d3

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2