Extracted

• • Target
    0d0f825f1e0f5124cc5543276d6c140d
  • Size 13.3MB
  • SHA256 2657ffa6aa25d3deef2f9d75955d5a16c9930d32e5a0f8da8ed448d7bb9448cd
  • MD5 0d0f825f1e0f5124cc5543276d6c140d
  • SHA1 b8529471a54f3527564277a46d7a800fd870b661
  • SHA512 81db9556296ef3142a7674adbad7b1240255d818dcbcb8564dab37d051600266fcd7339a8281e6ae3e8dae7405d92c611b95b1094b177fef53b73b3ae4718f72
  • SSDEEP 98304:lNWUlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllR:jW
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2