Extracted

• • Target

    22e95da4d685cf7a8ca80be82b1a587da1094047cb200da81a61b44d515b6a16

  • Size

    10.7MB

  • MD5

    b68d1d16e51e6c79017a2374d6b072fb

  • SHA1

    ed811cfa8711a4e34b37eac3e10d3530def45ff4

  • SHA256

    22e95da4d685cf7a8ca80be82b1a587da1094047cb200da81a61b44d515b6a16

  • SHA512

    5a3f7acb9cd3bb29f588dcc524a048a9f9bb8cb553ff86044e8c2d682ceb541806a4b2d85818f09c5292de26b05063b77426cf5ac41824d2718ec64d56c686e8

  • SSDEEP

    24576:xeOeLIO66666666666666666666666666666666666666666666666666666666n:Ze

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2