Extracted

• • Target

    26ad093fdb234d05fe990c0e6a55333657846aa1c57f1556f414978f90ccf77f

  • Size

    139KB

  • MD5

    3b0ff58cc006313343c04edfcab9f9f5

  • SHA1

    61556a0c45658349e7fa9a7c0bfd6a47454ae029

  • SHA256

    26ad093fdb234d05fe990c0e6a55333657846aa1c57f1556f414978f90ccf77f

  • SHA512

    46d7ca45466812e801aeb0d645a626c7122f57ea61095316fdbf6be8d14a48c4ba6f0607e9ba1c25415df523245dacf3871018767a034431f7338d3d200a9ec4

  • SSDEEP

    3072:d4dJ7WcqHIc8XBRZ3Cle1zYDAkxKZDnhXZ2PGFm9qKAx:d4jeIc+dEe1kBKZ5Z2EuqK

  Score

  10^/10

  tofseepersistencetrojanupx

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Deletes itself

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2