Extracted

• • Target
    51c00f2268dbffddcd17612cc1c0823a
  • Size 14.1MB
  • SHA256 d12a5e566b0055bb51118a48444bcbfb3b9ad1a5a0679a72197365a25ff95b9d
  • MD5 51c00f2268dbffddcd17612cc1c0823a
  • SHA1 651622ca0da6b207ec41aa63c17e6d0ef69aab26
  • SHA512 ed3e7d4e4aa8ee57b5fac2928bbd517416f0af4a8023603758c5844bc78e4a6a0d60476a08446dff40fffb89640303d600056d4af767e59fc89e3bcbbc5c972a
  • SSDEEP 196608:nXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXn:
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Windows security bypass

    evasiontrojan

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2