Extracted

• • Target
    3ad2aec044029075ed9c164e1681faf8
  • Size 10.2MB
  • SHA256 ff2b1cc6b5905ea5609ffb52c098d2a2d251b1fbb28d37cac3e176203cd488fa
  • MD5 3ad2aec044029075ed9c164e1681faf8
  • SHA1 7b25f7895a94fb65ae9ca965c51b13c444b2b4f9
  • SHA512 a8d45c418c272ad341cc98064a3e42de7327d4901c1298c5dbb908e7442c71ae71681104c80dabcc620bc5679664f6732f0e0eb6d6e2f8889c5a97c9f5a92aaa
  • SSDEEP 6144:k5VCb4QuzFbpIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzn:C8NKFbp
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2