Extracted

• • Target

    21a0e859e84fcd7159996c98c8d9450845cf9dd4677edf6280b377e6f2e5ed9b

  • Size

    260KB

  • MD5

    e154be10e86c3b4ef92ec179ef7f8fd1

  • SHA1

    2a99469cbf4e7b4e8a9c466756a6ae88eb344967

  • SHA256

    21a0e859e84fcd7159996c98c8d9450845cf9dd4677edf6280b377e6f2e5ed9b

  • SHA512

    1434fcb691f52568f8e8d136cd1d2906c046d4f44be5adae2612e5193c4da1ca45af6226fe41b819710109d4b8bb9dbc45a981f01e64a3911726f7ac2ee2c80a

  • SSDEEP

    3072:PXEvKdWLyRcVeYX1T51b+aDMe3K/TtolpJU5AvXm9hZCRRzMuWZgd3n:/eLFVeYX1iSMU4TilUqXucqgd3

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1