Extracted

• • Target
    0bd4b17197a237a6b892cb49969e8b2b
  • Size 10.9MB
  • SHA256 32b88643109ff71687d0afd291967db514f6ba60f0c8fb6ab08cca85c71bb0c5
  • MD5 0bd4b17197a237a6b892cb49969e8b2b
  • SHA1 c3b747ef1d169a677c62b646382720507e884732
  • SHA512 5b431349caf2e0e106d969a356aa64127722562042ca2da313abe3b1852d36f2f7ba021e1112724bab718369ba649a7fb59b125ea6980fda419a6db71a09253a
  • SSDEEP 24576:pUqa71YB5DHlommmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmn:pF15
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2