Extracted

• • Target
    1e2e1af08d379134811a4cd10474714d.exe
  • Size 11.6MB
  • SHA256 3b096e70a59f87eabdcc239f9eac549cbdabb51ae3b82e299b9d840d3878a415
  • MD5 1e2e1af08d379134811a4cd10474714d
  • SHA1 fb6f3185b989a372d1d53ab7b50fbfd19be32046
  • SHA512 12dd43e0efeba2f974e7ae8bebe55109853670d4af991686a3fb529986eed32aefc8e86b3a5e5d9d2c5332f9d473a452dd8ae2ed5f2214c7a518dc189aeef9d1
  • SSDEEP 24576:sjY+lg48SlJPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP3:XHSl
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2