Extracted

• • Target
    7678b1a94db0fa6bdfaf6b23e9b85a5a
  • Size 344KB
  • SHA256 e142b01c4b04ddca2ffded33fa5e8e3accf2b305021efd57b485cb06f072e84e
  • MD5 7678b1a94db0fa6bdfaf6b23e9b85a5a
  • SHA1 effa765e210f053ada0a4d92bac09ae5e88b23bc
  • SHA512 aa5b4ab158b5f6e7d17eac40f4cb8f93a5c76df75a56469c1b25425a6d38a8fb568ee7a5f4d438b67fbf209299f9d6eaa3a6d9a8d393346e5e81f7d457b2a6f0
  • MD5 SHA1 SHA512

  Score

  10^/10

  tofseexmrigevasionminerpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner Payload

    miner

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2