Extracted

• • Target

    2570fd0805f9ef4070865a06a14ec7a0

  • Size

    13.2MB

  • MD5

    2570fd0805f9ef4070865a06a14ec7a0

  • SHA1

    164161104d9d8a343bff12048fdf578c6bbfc7f4

  • SHA256

    705a1a64abd45caa351fcdf99d7c7d30ccb7740b7e66eb5b892e16db4bb4bbf9

  • SHA512

    f3020219a4f1bcd7118b8579bc38dd9b56ed768d5596ed5e12791782c18a0665a8e0f29c61ca52c284860e73479acd38ac4b830507279a1d70e8adb1cb899355

  • SSDEEP

    12288:RB9zHI0G+1OD5eLRriDvvZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZz:RBRXLlo

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2