Extracted

• • Target
    0dc76217d02be035c40cc9144d29e8e2
  • Size 14.7MB
  • SHA256 e427622200c88a83c5264c45c0b9fac2f7f0522ec1b0f4ec03a32decb5f9fca6
  • MD5 0dc76217d02be035c40cc9144d29e8e2
  • SHA1 4a0b870c840ecd0f03d045451444122132504cc3
  • SHA512 208b256722a325c41d379617d134576a99109098944543c04994fc3c725076dfb21987d40537b891bd95e135d0f926ee6355baf8ec644747acd337f3d875d7f9
  • SSDEEP 49152:ZR8888888888888888888888888888888888888888888888888888888888888D:
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2