Extracted

• • Target

    189c5efc65e3b28e3536ffb8616766b36115b058ceb6548c87bb3e4d3a5e0232

  • Size

    11.7MB

  • MD5

    0b9eaf5502101f33252e46846f4db5a5

  • SHA1

    620b46abbe9d9e3884d28d85fe7b949c17538eda

  • SHA256

    189c5efc65e3b28e3536ffb8616766b36115b058ceb6548c87bb3e4d3a5e0232

  • SHA512

    23fda346f08da77d3158d0a9c464a382af17c9a5649ed4b89152dec01d2527ec0cb9f6d43d5b8decf7ebcf0d65e0906f69a2443e72605c4eb7f549a004ce378c

  • SSDEEP

    3072:x8NYa2qJjULtTNupQyEC6pxhhfm5OcVi:xsRItTNKr2f45

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2