Extracted

• • Target
    f557af1a5cdb18ade1bdfe8de2f013e4
  • Size 307KB
  • SHA256 f16238cbe16b93a141e4e8f026b9ce3ca393f63d78c1b7b6ff2e0ed19f240f5e
  • MD5 f557af1a5cdb18ade1bdfe8de2f013e4
  • SHA1 012f45b94ef9e094dcd7aa9f0652a94636d60d6b
  • SHA512 0777cf3d77198e87c3773a8981f496b8fe7051c7e98925a179b408542b92f35da18898728c7cbc00c2b163e7f8522f93a5a9ebdda2f75f968cfa50fdee341490
  • SSDEEP 6144:gYW4bJjVzzxDDIA0QKm8T5BSqqROmiJK0dI7xAMI:g94bzzxDcA0QKj2q1mKDdI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2