Extracted

• • Target
    01e7399665fb666967364e6d28b461d9
  • Size 14.5MB
  • SHA256 e85a0596ff82987f0b4cf78140a43650ae7af258edebca34924a2baa58304632
  • MD5 01e7399665fb666967364e6d28b461d9
  • SHA1 8f75397db09e07565dab1e45d45d85e5f42503ff
  • SHA512 d2a0443676b6c4b46939fbb136825b91eb3fe5f1c3f459d5e84397a2b9a1d75782cd9417f7c4af8148ebd2a7cdd9b830696a7fb2f1ce9d4da0f68f2b160cf658
  • SSDEEP 98304:bjhd88888888888888888888888888888888888888888888888888888888888H:b
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2