Extracted

• • Target

    file.exe

  • Size

    175KB

  • MD5

    d382d253438178a44d67bcbaa981ef3b

  • SHA1

    0e1c782df01cef179ac0f189689e061bb987bdc0

  • SHA256

    d249a482a32a8ec7fcd413b4788623427381bfa1eda1d9830a81d0d32a253fac

  • SHA512

    2949e7be5b683c875dadc838505f6265c93bc4fb37fee1d62bb1f663634671aabdf820d8cf85ed90e760f617cbe0bad9a5455e2bb4468daf5c0f5db36073a207

  • SSDEEP

    3072:9uBNaqoS6nDTU1EKmqGlKyKwFkDtwkTGvX4IbDphSxRr79pq:kEql6nDTU1EKRGlKyJAG/zXphSH7

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2