Extracted

• • Target

    1796279f87df5f4d66030525b7e8e39c

  • Size

    13.8MB

  • MD5

    1796279f87df5f4d66030525b7e8e39c

  • SHA1

    a45b65e9060ca0d28fd2875b22b8540067db6832

  • SHA256

    00a414b5c275653c18a3cc06ae1d1d9de9e07144f0a6091fa46f51e482a0dae6

  • SHA512

    8b381fd38d8a538a408a29c70d2532403e36caadae46bf20b2f1786cbe1942c67ca310a4faab777b5c576062cd2ecf57c4edac5526cbf96a6e6dd413f2950b06

  • SSDEEP

    3072:8kAgDr/XSqon0LUwWQ2UHxqms7/7btm52yls2LC5J8ZWwoQSwgeb7hiOiPg0tGif:8khDr/+0LUdbKhsMs268UoSwrb7SpG

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2