Extracted

• • Target

    52d8fa9ee626d49fecea61e9431d0be8

  • Size

    13.5MB

  • MD5

    52d8fa9ee626d49fecea61e9431d0be8

  • SHA1

    40e3e3a7c7cb5c1d40d3f1252f2fd984309e7020

  • SHA256

    17347141b2a5a420b1f6c443becc9b1ce34dd17584e07a3f26b2f1023aa53a0e

  • SHA512

    6c6f1c5a436b2241322c20c7450bfe0f77b0de2d8d0d4b5f235fc14c42c466d4fd3df70b0a5fc06f1e35b112a0915077681005c307e024288e9b64bc1808c2db

  • SSDEEP

    196608:CPHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHHn:C

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2