Extracted

• • Target
    3c76d5aa8de1b32addf4299acb170e3d
  • Size 13.0MB
  • SHA256 0e32b2bbd0347fc8b4eae683f22b1d34f2c5514ae863c32fe2fc32089219a70b
  • MD5 3c76d5aa8de1b32addf4299acb170e3d
  • SHA1 a5a172dccbe1fbb50ef8afb7a4edfe9531138df3
  • SHA512 b6fa9e3a6316b3e1ae51d33b51e8b58e7b6f33ee49b6153c2a8d2a45634c404570860a4e9337c72d341df9f6a8a22364408ab2e3bf66a6655ffdeb921683a551
  • SSDEEP 24576:BYQkpx/ORHsD000000000000000000000000000000000000000000000000000M:CQm/rR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojanupx

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Suspicious use of SetThreadContext

  behavioral1behavioral2