Extracted

• • Target
    4a585ee0c216369f0392abd7b7ef0c1c
  • Size 11.4MB
  • SHA256 3fb717331c0f4b48744117e7844a4bcf08333af621cfcfe790d4a5e2dcf810fe
  • MD5 4a585ee0c216369f0392abd7b7ef0c1c
  • SHA1 ecd87636940b7b7b650bae8c43f4d7afbcb291ec
  • SHA512 8beae9f3b75758469f155b9b8a91d030e3282ab7414edc6ec47572aae5c87e944aec40cb627abc3d0c1c4f7c0730f32d02f1ec7e5511aa4dfc4b610b14a2b5c7
  • SSDEEP 24576:OjCj10HSqGgeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeW:O/D
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2