Extracted

• • Target
    0cde7523f9306133e846dbc71e48eede
  • Size 11.5MB
  • SHA256 203694f0c55e49f55c8b4d536ad636057b08134ac4af3236b9037ca5dd390cfb
  • MD5 0cde7523f9306133e846dbc71e48eede
  • SHA1 a48b4d47560c026ef8206f7ee2857f5d606f215a
  • SHA512 03702471ffb32ce08323b278d0c697d892a55d5d0f0a508befb660065805e7c3235c4b712acb4b22434c7be0942b0aeaf084a46161e2b0f521feace252a40c03
  • SSDEEP 24576:6htJbmFQuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuue:DF
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2