Extracted

• • Target

    441e73a5035fc9c2c7bb4d107a387555

  • Size

    12.9MB

  • MD5

    441e73a5035fc9c2c7bb4d107a387555

  • SHA1

    18055cb347306142b605aa2c30fb78c07046c9af

  • SHA256

    74e094670f0a5fc6285c8c3982d1b21df6574aaa4de3736fbf2057610be709a1

  • SHA512

    6ab39a7e22a82cdd13bcb21347c22d269312f1673adb427931ce6939f55419ec431fd02f2899b283960415aab77999415736aa337487da88e39adac44f6e0d09

  • SSDEEP

    196608:p3qqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq3:p

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2