Extracted

• • Target
    3b696af7cfd148fd53fcd760e2967ea8
  • Size 12.4MB
  • SHA256 0274ac69e9e961cb0729471460e617ecef53036c04ea8f1c1c02d9ae2fb7d681
  • MD5 3b696af7cfd148fd53fcd760e2967ea8
  • SHA1 46e39bdb3b160c8f3c1ef5acbc63c63d0198a7fc
  • SHA512 82e181bb0885d088e225025785f3f5212c4e86985a638de4d72333c6e961e0f5eff72c4159b5668fcac7fd4a5578e23e48ef23ea0ea976b4e55bbc39f4519d21
  • SSDEEP 24576:ZlxdvCcpOKCtBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBR:ZlzOR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2