Extracted

• • Target
    dab279cd4fb7c4ca8549c80d1fc0eaf2.exe
  • Size 327KB
  • SHA256 5cc29d4752c32a15d1c93abd02fe1cbcc525684f4fb9f10e3ad517f67b06fc80
  • MD5 dab279cd4fb7c4ca8549c80d1fc0eaf2
  • SHA1 59c5f15531f0c2c1b956e26c29973c9eb2de0c20
  • SHA512 a6aa6a80f26a7bf4b04b9c9d35920dcc9562339cb9c54d9726c57d38702b07c090fa3f93597b69ecb8d680bcde1f62b8c87ca9ec680efacd8912df45007d6d08
  • MD5 SHA1 SHA512

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Suspicious use of SetThreadContext

  behavioral1behavioral2