Extracted

• • Target
    05d67f82c9933f8b9ee66d28f868dd4d
  • Size 13.3MB
  • SHA256 2ebdde8a101f5e49aa4a5da2a014a0e154a55eb74a447d2ec60adf0a8ad2b666
  • MD5 05d67f82c9933f8b9ee66d28f868dd4d
  • SHA1 9e79b9992ff163bed0d4acf3e5557f1980d83333
  • SHA512 625572fd14f9bf97230d164615c2290ddd3c5fc873178b13a7855f601551d939f9b9812f27e703252919dfe91603e8077d2129a4b8b2def749d3df6c64b8a0ef
  • SSDEEP 49152:GkVuhFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFn:Gk
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2