Extracted

• • Target

    0e93b345b164d54c41d40ed86a860ec279c444a7dd809ae8fe31c12ed8848033

  • Size

    196KB

  • MD5

    371e8928f2518f19e3439a7f1870b6ce

  • SHA1

    685d65f85a1e23324fa378f9301a36a52ace4759

  • SHA256

    0e93b345b164d54c41d40ed86a860ec279c444a7dd809ae8fe31c12ed8848033

  • SHA512

    32703ea0d84be57d5efda99d0a4746d1c4fb5e6a634d24fe8760b6bfbeb23141f34212ea4d17c35497635f2ee4b02aba482577b1f1f3cc872bce903c6604787e

  Score

  10^/10

  tofseepersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2