Extracted

• • Target
    0bcfea1fc56a9a1e848ec7f654f63ab0
  • Size 14.5MB
  • SHA256 e3a865793575dddcdb926aee82c24accb320862e047141baf615e77e0a511f95
  • MD5 0bcfea1fc56a9a1e848ec7f654f63ab0
  • SHA1 ed727b4cb6319c1c5957d515b34f0e464fa1581e
  • SHA512 6d21b2fb9ed005f2e2b9363527d763220e69f2a5df0843ddd1c8d049ec4f7f10de0b9a2e2abaf7bee6bdbf37ec0033cecc2c8238fa896912d31670a1c724e728
  • SSDEEP 12288:WKBz1FxKfGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGGm:9Bz1Fx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2