Extracted

• • Target

    19b941ca46e34d47ec52dc3248c1cfb4

  • Size

    12.8MB

  • MD5

    19b941ca46e34d47ec52dc3248c1cfb4

  • SHA1

    5f50bf90cf8cbaeb31db2258b6ee869bba723462

  • SHA256

    3f3c63071ab9751ad62d9ebe72017d51a5bb99aac712fb291aa1bcbd6b10d62f

  • SHA512

    4e15d47c7ca273606bf0a57a4442ca96b6149cc765dab98da0b6757736cca97e50fa1e6a7e1a58a89dbed471ceafc3597a5339bc9bb764cc53ef37ad89d79e9a

  • SSDEEP

    49152:gj5555555555555555555555555555555555555555555555555555555555555b:

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2