Extracted

• • Target
    0525c45598e788b467687fdd0685f3ec
  • Size 13.3MB
  • SHA256 15ea9633ebefcd0ff1de7ca53915f940e98fde85c3621124f3798dabb80b04ba
  • MD5 0525c45598e788b467687fdd0685f3ec
  • SHA1 c2c4efb76132fe3f05623be05b3af41beade3e63
  • SHA512 ed0e262e809fb61d706222113283b53c4c03edf181b245a08f2934658feeb19360ae3a951e0e347e341b5c1abb729cf2f097e711ea7e4e9f4fc3e22f5c8d16f9
  • SSDEEP 24576:TjDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBp:Tnh
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2