Extracted

• • Target

    4718067e3e7b2de52dcdb60475f4f800

  • Size

    12.5MB

  • MD5

    4718067e3e7b2de52dcdb60475f4f800

  • SHA1

    e8dc7059536917d1e9bd7d0aff721f945785db1d

  • SHA256

    b2b52413eb8374756d3fff43e2f16d6229dc1327edd1f5fb225bd3c0fecad4f8

  • SHA512

    3f5866d8bf4ea81143be22e032643677d01d7fa8e2cc77d5a5c68c03c2c8697b8241ebe6c60f96bc7b36651d26073f568a9204158523ab48962c1e337eb55561

  • SSDEEP

    49152:CWqmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm7:

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2