Extracted

• • Target
    5219ae8b49d9430de458aca19cd0d490
  • Size 13.3MB
  • SHA256 fd6951fac18ed6a157eee8cf58889ade60eb3e727fcb0b5b7d2f945c8016f7ff
  • MD5 5219ae8b49d9430de458aca19cd0d490
  • SHA1 8bbf329910c28982d1ef33fc8e7cfc79689a19cb
  • SHA512 5d159d91133aa1a17a79a8440d53a501557544a135c3ecf0724eddb7725268656c5c19b1fafaafa2cea957821bdae28aeb9b1c29150f8e88bd5d030ae8ba2a02
  • SSDEEP 393216:MooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooX:MooooooooooooooooooooooooooooooX
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  tofseeevasionpersistencetrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Creates new service(s)

    persistence

  • Modifies Windows Firewall

    evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2