Extracted

• • Target
    f3baa4ed45dc9d0b254f70e6e4b0ac0f.exe
  • Size 344KB
  • SHA256 16fdbb6f45f722fffffafa455e8c5dd268c895e6b050031f40ab557be5240332
  • MD5 f3baa4ed45dc9d0b254f70e6e4b0ac0f
  • SHA1 b3aa03c4bebf4d65227f54f2cafd1e50daa8aebe
  • SHA512 13d2af499e0ae5819ced2d9086926dbd73259efa24e64705651899f6f1d730e8ed0b36d3438d4271a9254979f132523a3fb9f0994bb77a2a1d2105618f0bbb4a
  • MD5 SHA1 SHA512

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner Payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2