Extracted

• • Target

    12ea2803817cfe70a85e0766b35de554.exe

  • Size

    14.8MB

  • MD5

    12ea2803817cfe70a85e0766b35de554

  • SHA1

    df4fbcfa11b195bd8836c8ad7ec86c7ab9e0299f

  • SHA256

    4f743258a31bb67f3b4a52a2ce3b63cbdb9f1e4c2727a42787f3d0d13f803d60

  • SHA512

    9dde9a20f5c14503d678044f6e7070878218e26f9f7dbd70b042d7cf4696497501e8e3c8e3eca99084afce80c85aaf64f2ce83adf8c305c9c56c491fe411f059

  • SSDEEP

    49152:Kgnttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttn:K

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2