Extracted

• • Target

    file

  • Size

    243KB

  • MD5

    cb7d981a41514e05e06f245e41def1b1

  • SHA1

    e72486411d3f0d30143cca799ff5b22c719db778

  • SHA256

    27fca545923d2b0afc8f1075cb68eea4ebfb38e1e4184883ada0a5f24e9e014d

  • SHA512

    98b2d86c95350993d9adde9b8af9ca6d876b8976bf194f832129c39481ab0f86b547e2a1e3d631e8c783d0e680e91408fb756e95329049604cc1216fb5f4daa5

  • SSDEEP

    3072:ErEg4+jlrQ/peokrb2aapOQ49yDe206gqzANPtyu/uf4nm3CQ4++5lmj:RkQpeoSb2aVZU0+ARtyuW6fT5lm

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2